March 19, 2019—KB4489887 (Preview of Monthly Rollup)

None None...

March 19, 2019—KB4489892 (Preview of Monthly Rollup)

None None...

Timing Attack

github.com/youtube/vitess is vulnerable to timing attack. The usage of an insecure password comparison function entry.Password == password in vitess/go/mysql/authserverstatic.go allows a remote attacker to determine a user's password by analyzing the server response. This is due to early aborting...

Timing Attack

github.com/youtube/vitess is vulnerable to timing attack. The use of an insecure String comparison function bytes.Compare in vitess/go/mysql/authserverstatic.go allows a remote attacker to discover users' plaintext passwords by analyzing response time from the server. The attacker will require th...

OpenCart Price Comparison Store 3.x Open Redirection

Exploit Title : OpenCart Price Comparison Store Modules 3.x Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 11/03/2019 Vendor Homepage : opencart.com Software Information Link :...

Code injection

Usage of non-time-constant comparison functions can lead to information leakage through side channel analysis in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,...

February 19, 2019—KB4487029 (OS Build 17134.619)

None None...

Security Bulletin: IBM System x Integrated Management Module (IMM) Lighttpd W (CVE-2011-4362, CVE-2010-0295, CVE-2008-4360, CVE-2008-4359, CVE-20084298, CVE-2008-1531)

Summary Older versions of lighttpd, used by System x IMM contain multiple vulnerabilities. Vulnerability Details Abstract Older versions of lighttpd, used by System x IMM contain multiple vulnerabilities. Content Vulnerability Details: CVE ID: CVE-2011-4362 Description: Integer signedness error i...

Router exploitation of the Stack Overflow entry a-vulnerability warning-the black bar safety net

MIPS instruction set is mainly used in some embedded IOT devices, such as Router, camera. To these devices for binary vulnerability mining you need to have the MIPS to have a certain familiar. The MIPS instruction set of Stack Overflow and the x86 instruction set is different, so the exploits is...

Timing Attack

jasypt is vulnerable to timing attacks. The attacks are possible because it uses Arrays.equals to verify passwords with different lengths, thereby revealing the time taken to compare the passwords...

Timing Attack

SimpleCrypto.Net is vulnerable to timing attack. A non-constant time comparison function used to compare passwords allow remote attackers to determine valid passwords by analyzing the server response time...

FAST or Burp or both?

By @aLLy , Wallarm Research Hello guys, time to talk details about Wallarm FAST Framework for Application Security Testing. It’s a new automatic web vulnerability scanning and fuzzing detection tool by Wallarm Inc. It is well suited for security researchers in enterprise Red Teams as well as for...

ALPINE-CVE-2018-16395

An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one...

CVE-2018-16395

Removed by vendor...

openssl security, bug fix, and enhancement update

1.0.2k-16.0.1 - sha256 is used for the RSA pairwise consistency test instead of sha1 1.0.2k-16 - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA - fix incorrect error message on FIPS DSA parameter generation 1603597 1.0.2k-14 - ppc64le is not multilib architecture 1585004...

CVE-2018-11846

The use of a non-time-constant memory comparison operation can lead to timing/side channel attacks in Snapdragon Mobile in version SD 210/SD 212/SD 205, SD 845, SD 850...

Design/Logic Flaw

The use of a non-time-constant memory comparison operation can lead to timing/side channel attacks in Snapdragon Mobile in version SD 210/SD 212/SD 205, SD 845, SD 850...

CVE-2018-11846

The CVE-2018-11846 entry affects Snapdragon Mobile: SD 210/SD 212/SD 205, SD 845, and SD 850. The root cause is a non-time-constant memory comparison operation that can create timing/side-channel attacks. Exploitation details are not provided in the documents; there is no public exploit informati...

UBUNTU-CVE-2018-16395

An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one...

Moderate severity vulnerability that affects org.apache.mesos:mesos

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token JWT. In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timi...