Insecure String Comparison

zencashjs uses an insecure string comparison. This is due to a clash of address prefixes for testnet P2PKH and mainnet P2SH addresses. The package interprets transactions sent to a zt P2SH address on mainnet as P2PKH transactions erroneously. Any funds sent to a mainnet P2SH multisignature addres...

The vulnerability of the imgcmp image comparison tool, related to segmentation errors, allows a hacker to cause a service failure.

The vulnerability of the image comparison utility imgcmp is related to segmentation errors. Exploiting this vulnerability can allow an attacker to cause a service failure in the application by entering a specially crafted sequence of data into the command line...

Information Disclosure Through Timing Attack

actionpack and activesupport is vulnerable to information disclosure. The vulnerability exists as timing attack was possible through the lack of constant time string comparison made for the message digest, causing information disclosure...

Cross site request forgery (csrf)

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly...

PT-2019-20035

Name of the Vulnerable Software and Affected Versions express-basic-auth versions prior to 1.1.7 Description The issue concerns the use of native string comparison instead of a constant time string comparison in the express-basic-auth package. This can lead to timing attacks, which may increase t...

USN-4001-2: libseccomp vulnerability

USN-4001-1 fixed a vulnerability in libseccomp. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Jann Horn discovered that libseccomp did not correctly generate 64-bit syscall argument comparisons with arithmetic operators LT, GT, LE, GE. An attacker...

Oracle Linux 6 / 7 : curl (ELSA-2019-4652)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4652 advisory. - CVE-2016-8615 cookie injection for other servers https://curl.haxx.se/docs/CVE-2016-8615.html - CVE-2016-8616 case insensitive password compariso...

Announcing the all new Attack Surface Analyzer 2.0

Few of us know what is really happening on our systems when we install new software from new or untrusted sources. This is important because most installation processes require elevated privileges, which can lead to undesired system configuration changes. Knowing what changes have been made is...

EulerOS Virtualization 3.0.1.0 : sqlite (EulerOS-SA-2019-1425)

According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was found that SQLite's sqlite3VdbeExec function did not properly implement comparison operators. A local attacker could submi...

Timing Attack

express-basic-auth is vulnerable to timing attacks. The usage of native string comparison allows a remote attacker to guess secrets such as user passwords by analyzing server response time on different input...

Introducing the security configuration framework: A prioritized guide to hardening Windows 10

In the past, we left defining the security configuration for Windows 10 as a task for every customer to sort out. As a result, we saw as many different configurations as we saw customers. Standardization has many advantages, so we developed a security configuration framework to help simplify...

Updated libssh2 packages fix security vulnerability

Possible integer overflow in transport read allows out-of-bounds write. CVE-2019-3855 Possible integer overflow in keyboard interactive handling allows out-of-bounds write. CVE-2019-3856 Possible integer overflow leading to zero-byte allocation and out-of-bounds write. CVE-2019-3857 Possible...

[SECURITY] Fedora 30 Update: wget-1.20.3-1.fc30

GNU Wget is a file retrieval utility which can use either the HTTP or FTP protocols. Wget features include the ability to work in the background while you are logged out, recursive retrieval of directories, file name wildcard matching, remote file timestamp storage and comparison, use of Rest wit...

Apache HTTP Server < 2.4.39 mod_http2 Use-After-Free Vulnerability - Linux

Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a reference...

Apache HTTP Server < 2.4.39 mod_http2 Use-After-Free Vulnerability - Windows

Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a reference...

Insecure Variable Comparison

Caucho Quercus uses an insecure variable comparison. When using the == operator for comparison of variables of various types, there is a possibility of variable comparisons to always result in a TRUE state...

The vulnerability of the memcmp function in the GNU C library (glibc) arises from insufficient input validation, allowing attackers to trigger a denial-of-service attack.

The vulnerability of the memcmp function in the GNU C library glibc is related to insufficient checking of input data. Exploiting this vulnerability can allow an attacker to cause a system failure...

CVE-2019-9893

libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators LT, GT, LE, GE, which might able to lead to bypassing seccomp filters and potential privilege escalations...

UBUNTU-CVE-2019-9893

libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators LT, GT, LE, GE, which might able to lead to bypassing seccomp filters and potential privilege escalations...

CVE-2019-9893: Undefined Security Weakness

libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators LT, GT, LE, GE, which might able to lead to bypassing seccomp filters and potential privilege escalations...