3468 matches found
PT-2017-13636
Name of the Vulnerable Software and Affected Versions Cash Back Comparison Script version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the PATH INFO to the "search/" endpoint. Recommendations For version 1.0, consider restricting access...
Android Lockscreen Patterns Less Secure Than PINs
An academic study set out to prove whether it’s better to protect your Android phone with a PIN or a swipe pattern. The answer is PIN. At least when it comes to proximity attacks, namely someone lurking about trying to guess your PIN or unlock pattern. The study PDF, published Friday by researche...
Timing Attack
laravel/framework is vulnerable to timing attacks. The library does not compare rememberme tokens in constant-time, which allows attackers to use the timing of the request to progressively identify a valid token...
Timing Attack
emarref/jwt is vulnerable to a timing attack. It is possible because the verify function in Symmetric.php does not compare hashes in constant time, allowing malicious users to guess valid hashes based on the time that a comparison takes...
CVE-2017-14687: Improper Restriction of Operations within the Bounds of a Memory Buffer
Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016cb4f" on Windows. This occurs because of mishandling of XML tag name...
PT-2017-13624
Name of the Vulnerable Software and Affected Versions Artifex MuPDF version 1.11 Description The issue allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because of mishandling of XML tag name comparisons, related to "Data...
Timing Attacks
kohana/core is vulnerable to timing attacks. The library is vulnerable because it does not compare hashes in constant-time, which allows attackers to use the timing of the request to progressively identify a valid hash...
CVE-2014-8684
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes...
CVE-2014-8684: Undefined Security Weakness
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes...
PT-2017-6256
Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 3.0 Kohana versions 3.2.3 and earlier Kohana versions 3.3.x through 3.3.2 Description The issue makes it easier for remote attackers to spoof session cookies and conduct PHP object injection attacks. This is...
Timing Attack
craftcms/cms is vulnerable to timing attack. The application uses the strcmp function that compares hashes in non-constant time, allowing an attacker to use the timing of the request to progressively identify the current PHP session id...
How to Upgrade Receiver from StoreFront
Question: How to upgrade Receiver from StoreFront? Answer: 1. Go to C:\Program Files\Citrix\Receiver StoreFront\Receiver Clients\. Create a Windows folder if it doesn’t exist. 2. In the Windows folder, paste the Receiver for Windows with the version you want to set as the threshold, overwriting...
DEDECMS member center code submit defects can getshell
Preface : dedecms this year to update a lot of patches,the present article selected 20170315 patch for learning and research. Body: From the official website to download DEDECMS 20170315 patch using DIFF comparison tools for comparison: See the Red part, the servermsg1 variables appearing in dede...
Timing Attack
automattic/jetpack is vulnerable to timing attacks. This vulnerability is caused because the secrets are not compared in constant time, allowing malicious users to guess the valid secrets based on the time that a comparison takes...
Timing Attack
automattic/jetpack is vulnerable to timing attacks. This vulnerability is caused because the signatures are not compared in constant time, allowing malicious users to guess the valid signatures based on the time that a comparison takes...
Timing Attack
jetpack is vulnerable to timing attacks. This vulnerability is caused because the HMAC hashes are not compared in constant time, allowing malicious users to guess the valid HMAC hashes based on the time that a comparison takes...
CVE-2017-12872
The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...
DEBIAN-CVE-2017-12872
The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...
CVE-2017-12872
The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...
