DSA Study Hub 安全漏洞

DSA Study Hub is an interactive data structure and algorithm learning platform developed by toxicbishop, a personal developer. Previous versions of DSA Study Hub d527fba had security vulnerabilities. These vulnerabilities stemmed from the fact that authentication tokens were stored in HTTP cookie...

Debian dsa-6154 : libapache2-mod-php8.2 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6154 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6154-1 [email protected] https://www.debian.org/securit...

pqc-combo (0.1.0), pqc-fips (0.0.3) +1 more potentially affected by unknown CVE via libcrux-ml-dsa (0.0.4)

libcrux-ml-dsa CARGO version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ml-dsa and may be impacted: - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0077...

pqc-combo (0.1.0), pqc-fips (0.0.3) +1 more potentially affected by unknown CVE via libcrux-ml-dsa (0.0.4)

libcrux-ml-dsa CARGO version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ml-dsa and may be impacted: - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0076...

libcrux-digest (>=0.0.4-pre.1, <=0.0.6), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +7 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2, <=0.0.7-pre.2)

libcrux-sha3 CARGO version =0.0.2, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =0.0.2-alpha.3 - libcrux-psq 0.0.2-beta.3 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0074...

DSA-6154-1 php8.2 - security update

Bulletin has no description...

Debian: Security Advisory (DSA-6151-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-6148-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-6144-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DSA-6138-1 libpng1.6 - security update

Bulletin has no description...

Missing Cryptographic Step

Overview org.webjars.npm:jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by...

Improper Verification of Cryptographic Signature

Overview org.webjars.npm:jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic and the related DSA/X509 verification flow ...

Debian dsa-6134 : pdns-recursor - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6134 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6134-1 [email protected] https://www.debian.org/securit...

DSA-6124-1 wireshark - security update

Bulletin has no description...

Debian dsa-6121 : libtomcat11-embed-java - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6121 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6121-1 [email protected] https://www.debian.org/securit...

Debian: Security Advisory (DSA-6118-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ml-dsa's UseHint function has off by two error when r0 equals zero

Summary There's a bug in the usehint function where it adds 1 instead of subtracting 1 when the decomposed low bits r0 equal exactly zero. FIPS 204 Algorithm 40 is pretty clear that r0 0 means strictly positive, but the current code treats zero as positive. This causes valid signatures to...

ap-proxy-client (>=0.3.0, <=0.8.0), ap-proxy-protocol (>=0.3.0, <=0.8.0) +2 more potentially affected by unknown CVE via ml-dsa (0.0.4)

ml-dsa CARGO version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on ml-dsa and may be impacted: - ap-proxy-client =0.3.0, =0.3.0, =0.1.0, =0.0.1-pre.0, =0.0.12 Source cves: unknown CVE Source advisory: OSV:GHSA-H37V-HP6W-2PP8...

DSA-6116-1 chromium - security update

Bulletin has no description...

GHSA-5X2R-HC65-25F9 ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices

Affected Crate: ml-dsa Affected Versions: v0.1.0-rc.2 and commits since b01c3b7 Severity: Medium Reporter: Oren Yomtov Fireblocks Summary The ML-DSA signature verification implementation in the RustCrypto ml-dsa crate incorrectly accepts signatures with repeated duplicate hint indices. According ...