373 matches found
CVE-2024-29937
NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to memory corruption...
PT-2024-14964 · Synaptics · Synaptics Fingerprint Driver
Name of the Vulnerable Software and Affected Versions: Synaptics Fingerprint Driver affected versions not specified Description: The issue allows an attacker to set up a TLS session with the fingerprint sensor and send restricted commands to it by using an encryption key derived from static...
Permanent DOS in liquidity_lockbox for under $10
Lines of code Vulnerability details Impact The liquiditylockbox contract in the lockbox-solana project is vulnerable to permanent DOS due to its storage limitations. The contract uses a Program Derived Address PDA as a data account, which is created with a maximum size limit of 10 KB. Every time...
CVE-2022-24403
The TETRA TA61 identity encryption function internally uses a 64-bit value derived exclusively from the SCK Class 2 networks or CCK Class 3 networks. The structure of TA61 allows for efficient recovery of this 64-bit value, allowing an adversary to encrypt or decrypt arbitrary identities given on...
TETRA BURST Security Vulnerability
TETRA BURST is a terrestrial trunked radio standard for radio communications from TETRA BURST. A security vulnerability exists in TETRA BURST that stems from a flaw in the authentication algorithm, which can be exploited by an attacker to set the derived cipher DCK to 0. The vulnerability is caus...
[SECURITY] Fedora 38 Update: ntpsec-1.2.2a-1.fc38
NTPsec is a more secure and improved implementation of the Network Time Protocol derived from the original NTP project...
CVE-2023-21652
Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use...
Stack overflow
Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use...
CVE-2023-21652
CVE-2023-21652 describes a cryptographic issue in HLOS where derived keys used to encrypt/decrypt information remain on the stack after use. The vulnerability is noted across multiple sources (e.g., Red Hat, NVD, PRION/Vuln enrichment) with the CVSS v3.1 base metrics indicating HIGH impact for co...
PT-2023-18315 · Hlos · Hlos
Name of the Vulnerable Software and Affected Versions: HLOS affected versions not specified Description: A cryptographic issue exists where derived keys used for encryption and decryption remain present on the stack after use. Recommendations: At the moment, there is no information about a newer...
SUSE CVE-2010-3834
Unspecified vulnerability in MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service server crash via vectors related to "materializing a derived table that required a temporary table for grouping" and "user variable...
SUSE CVE-2021-36374
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives...
Siemens Desigo PXC and DXR Devices Uncontrolled Resource Consumption (CVE-2022-24040)
A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application fails to enforce an upper bound to the cost factor of the PBKD...
vinaseed.com.vn Cross Site Scripting vulnerability OBB-2791575
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
GHSA-R2XF-W5PJ-9PW8 Apache Syncope JEXL Code Injection
Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."...
se.huaruileddriver.com Cross Site Scripting vulnerability OBB-2535762
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
mailman: CSRF token derived from admin password allows offline brute-force attack
Sensitive information is exposed to unprivileged users in mailman. The hash of the list admin password is used to derive the CSRF Cross-site Request Forgery token, which is exposed to unprivileged members of a list. Malicious members may use the CSRF token to perform an offline brute-force attack...
americadourada.ba.gov.br Cross Site Scripting vulnerability OBB-2239270
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2021-38703
Wireless devices running certain Arcadyan-derived firmware such as KPN Experia WiFi 1.00.15 do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be...
CVE-2021-38703
Wireless devices running certain Arcadyan-derived firmware such as KPN Experia WiFi 1.00.15 do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be...