ROS-20240404-08

Vulnerability of GnuTLS transport layer cryptographic library is related to difference of response time when processing RSA ciphertext in ClientKeyExchange message with correct and incorrect addition of PKCS1. PKCS1 padding. Exploitation of the vulnerability could allow an attacker acting remotel...

jose-go: improper handling of highly compressed data

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...

jose-go: improper handling of highly compressed data

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...

golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.goL113. The objects leaked are pkey​ and ctx​. That functi...

CVE-2023-6951

CVE-2023-6951 concerns a Use of Weak Credentials affecting DJI drone Wi‑Fi networks (Mavic 3 Pro <= v01.01.0300, Mavic 3 <= v01.00.1200, Mavic 3 Classic <= v01.00.0500, Mavic 3 Enterprise <= v07.01.10.03, Matrice 300 <= v57.00.01.00, Matrice M30 <= v07.01.0022, Mini 3 Pro

nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)

A flaw was found in Node.js. The privateDecrypt API of the crypto library may allow a covert timing side-channel during PKCS1 v1.5 padding error handling. This issue revealed significant timing differences in decryption for valid and invalid ciphertexts, which may allow a remote attacker to decry...

IBM Security Verify Directory encryption vulnerability

IBM Security Verify Directory is part of an authentication and access management solution from International Business Machines IBM. IBM Security Verify Directory version 10.0.0 suffers from a cryptographic issue vulnerability that stems from the use of weak encryption algorithms, which could be...

SUSE CVE-2018-25099

In the CryptX module before 0.062 for Perl, gcmdecryptverify and chacha20poly1305decryptverify do not verify the tag...

DEBIAN-CVE-2018-25099

In the CryptX module before 0.062 for Perl, gcmdecryptverify and chacha20poly1305decryptverify do not verify the tag...

CVE-2018-25099

In the CryptX module before 0.062 for Perl, gcmdecryptverify and chacha20poly1305decryptverify do not verify the tag...

CVE-2024-25654

Insecure permissions for log files of AVSystem Unified Management Platform UMP 23.07.0.16567LTS allow members with local access to the UMP application server to access credentials to authenticate to all services, and to decrypt sensitive data stored in the database...

LibTomCrypt Security Vulnerability

LibTomCrypt is a modular portable cryptographic tool that focuses on block ciphers, one-way hash functions, linking patterns and pseudo-random number generators for developers. A security vulnerability exists in LibTomCrypt versions prior to 0.062, which stems from a security flaw in the function...

AVSystem Unified Management Platform Security Vulnerability

AVSystem Unified Management Platform is a comprehensive management platform from AVSystem designed to help enterprises, service providers and carriers manage and monitor their network devices, Internet of Things IoT devices and services. A security vulnerability exists in AVSystem Unified...

CVE-2024-25655: Insecure Storage of Sensitive Information

Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform UMP 23.07.0.16567LTS allows members with read access to the application database to decrypt the LDAP passwords of users who successfully authenticate to web management via LDAP...

PT-2024-10618

Name of the Vulnerable Software and Affected Versions CryptX versions prior to 0.062 Description The issue concerns the CryptX module for Perl, where the functions gcm decrypt verify and chacha20poly1305 decrypt verify do not verify the tag, potentially leading to security issues. Recommendations...

LibTomCrypt Security Vulnerability

LibTomCrypt is a modular portable cryptographic tool that focuses on block ciphers, one-way hash functions, linking patterns and pseudo-random number generators for developers. A security vulnerability exists in LibTomCrypt versions prior to 0.062, which stems from a security flaw in the function...

GO-2024-2631 Decompression bomb vulnerability in github.com/go-jose/go-jose

An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...

PT-2025-6256 · Fortinet · Fortimanager

Name of the Vulnerable Software and Affected Versions: FortiManager versions 6.4 through 7.6.1 FortiManager version 7.0 Description: The issue is related to the use of a hard-coded cryptographic key in the FortiManager interface, which can allow a remote attacker to disclose confidential...

PT-2024-21538

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A data-race issue was identified in the Linux kernel when accessing keypair-receiving counter.counter. The issue was detected by Syzkaller with KCSAN and is related to the wg packet...

CVE-2024-28180

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Mitigation Mitigation for this issue is either...