157 matches found
CVE-2025-64753 grist-core has insufficient access control in endpoints for comparisons between documents and versions
grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...
Timing Attack
Dragonfly is vulnerable to Timing Attack. The vulnerability is due to the use of simple string comparisons in the Proxy feature’s access control mechanism, which allows an attacker to guess the password one character at a time by analyzing response time variations...
EUVD-2025-34730
Mattermost has an Observable Timing Discrepancy vulnerability...
CVE-2025-54499 Insecure string comparison enables timing attacks
Mattermost versions 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets...
EUVD-2013-4875
Malware in sbrugna...
EUVD-2016-9461
Malware in sbrugna...
EUVD-2015-7516
Malware in sbrugna...
EUVD-2018-3837
Malware in sbrugna...
EUVD-2017-16783
Malware in sbrugna...
EUVD-2019-19249
Malware in sbrugna...
EUVD-2012-0527
Malware in sbrugna...
EUVD-2015-0299
Malicious code in bioql PyPI...
EUVD-2025-29771
Malicious code in bioql PyPI...
EUVD-2024-3490
Malicious code in bioql PyPI...
EUVD-2023-1611
Malicious code in bioql PyPI...
CVE-2025-59432
SCRAM Salted Challenge Response Authentication Mechanism is part of the family of Simple Authentication and Security Layer SASL, RFC 4422 authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals...
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication
The access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison instruction’...
CVE-2025-53940 Quiet uses insecure, inconsistent verification on local backend token
Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for tok...
The vulnerability of the sample_conv regsub function in server-side HAProxy software arises from incorrect comparisons using erroneous factors, allowing attackers to compromise the accessibility of protected information.
The vulnerability of the sampleconv regsub function in HAProxy-related software is related to incorrect comparisons when error factors are used. Exploiting this vulnerability can allow a malicious actor to compromise the accessibility of protected information...
