CVE-2023-3108 Kernel: a race condition in crypto module in the function skcipher_recvmsg

A flaw was found in the subsequent getuserpagesfast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipherrecvmsg of crypto/algifskcipher.c function. This flaw allows a local user to crash the system...

CVE-2023-3108 Kernel: a race condition in crypto module in the function skcipher_recvmsg

A flaw was found in the subsequent getuserpagesfast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipherrecvmsg of crypto/algifskcipher.c function. This flaw allows a local user to crash the system...

Upgraded Q -> 2 from #835 [1689085140858]

Judge has assessed an item in Issue 835 as 2 risk. The relevant finding follows: L-02 --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #727 [1689056893075]

Judge has assessed an item in Issue 727 as 2 risk. The relevant finding follows: ERC20 check success issue --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #727 [1689056911947]

Judge has assessed an item in Issue 727 as 2 risk. The relevant finding follows: ERC20 revert due to sigs issue --- The text was updated successfully, but these errors were encountered: All reactions...

CVE-2023-37710

Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the wpapskcrypto parameter in the fromSetWirelessRepeat function...

Moderate: Red Hat Security Advisory: Red Hat Service Interconnect 1.4 Release security update

This is release 1.4 of the rpms for Red Hat Service Interconnect. Red Hat Service Interconnect 1.4 introduces a service network, linking TCP and HTTP services across the hybrid cloud. A service network enables communication between services running in different network locations or sites. It allo...

golang: crypto/elliptic: panic caused by oversized scalar

An integer overflow flaw was found in Golang's crypto/elliptic library. This flaw allows an attacker to use a crafted scaler input longer than 32 bytes, causing P256.ScalarMult or P256.ScalarBaseMult to panic, leading to a loss of availability...

Tenda AC1206 缓冲区错误漏洞

Tenda AC1206 is a Wireless King Gigabit Router from Tenda, China. A security vulnerability exists in the Tenda AC1206 version V15.03.06.23, which is caused by a buffer overflow in the wpapskcrypto parameter of the fromSetWirelessRepeat method...

Upgraded Q -> 2 from #198 [1688918565387]

Judge has assessed an item in Issue 198 as 2 risk. The relevant finding follows: QA1. UlyssesPool.maxRedeem needs to consider the protocol fees. --- The text was updated successfully, but these errors were encountered: All reactions...

golang: crypto/elliptic: panic caused by oversized scalar

An integer overflow flaw was found in Golang's crypto/elliptic library. This flaw allows an attacker to use a crafted scaler input longer than 32 bytes, causing P256.ScalarMult or P256.ScalarBaseMult to panic, leading to a loss of availability...

CVE-2023-30590

A vulnerability has been identified in the Node.js, where a generateKeys API function returned from crypto.createDiffieHellman only generates missing or outdated keys, that is, it only generates a private key if none has been set yet...

Email crypto phishing scams: stealing from hot and cold crypto wallets

The higher the global popularity of cryptocurrencies and the more new ways of storing them, the wider the arsenal of tools used by malicious actors who are after digital money. Scammers tailor the complexity of technology they use and the thoroughness of their efforts to imitate legitimate websit...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2023-2292)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a...

Evasive Meduza Stealer Targets 19 Password Managers and 76 Crypto Wallets

In yet another sign of a lucrative crimeware-as-a-service CaaS ecosystem, cybersecurity researchers have discovered a new Windows-based information stealer called Meduza Stealer that's actively being developed by its author to evade detection by software solutions. "The Meduza Stealer has a...

Evasive Meduza Stealer Targets 19 Password Managers and 76 Crypto Wallets

In yet another sign of a lucrative crimeware-as-a-service CaaS ecosystem, cybersecurity researchers have discovered a new Windows-based information stealer called Meduza Stealer that's actively being developed by its author to evade detection by software solutions. "The Meduza Stealer has a...

CVE-2023-30586

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine API can be used to bypass...

CVE-2023-3249

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hiddenformdata' function. This makes it possible for authenticated attackers to log in as...

CVE-2023-3249 Web3 – Crypto wallet Login & NFT token gating <= 2.6.0 - Authentication Bypass

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hiddenformdata' function. This makes it possible for authenticated attackers to log in as...

CVE-2023-3249

The WordPress plugin Web3 – Crypto wallet Login & NFT token gating (Web3 authentication) is affected by CVE-2023-3249. Affected versions up to and including 2.6.0 suffer an authentication bypass due to an incorrect check in the hidden_form_data routine, allowing an authenticated attacker to log i...