2084 matches found
WinSCP < 6.3.3 Key Recovery Attack Vulnerability
The version of WinSCP installed on the remote Windows host is prior to 6.3.3. It is, therefore, affected by a key recovery attack vulnerability. In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in...
CVE-2024-42460
A flaw was found in the Elliptic NodeJS package where it fails to properly verify the leading bit for the R and S values used in the ECDSA signature. This issue may lead to a scenario where an attacker can modify the signature without the Elliptic library being able to properly reject it, causing...
CVE-2024-42461
A flaw was found in the Elliptic package for Node.js. ECDSA signatures encoded in BER format are improperly validated, allowing leading zeros to be added to the signature without invalidating it, resulting in confidentiality issues. Mitigation Mitigation for this issue is either not available or...
ECDSA Signature Malleability
Elliptic is vulnerable to Signature Malleability. The vulnerability is due to the acceptance of BER-encoded signatures which allows for the manipulation of ECDSA signatures...
ECDSA Signature Malleability
Elliptic is vulnerable to Signature Malleability. The vulnerability is due to the lack of verification for the leading bit of r and s in ECDSA signatures, allowing for signature manipulation...
OESA-2024-1924 botan2 security update
Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...
OESA-2024-1925 botan2 security update
Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...
OESA-2024-1923 botan2 security update
Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...
Elliptic's ECDSA missing check for whether leading bit of r and s is zero
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero...
Elliptic allows BER-encoded signatures
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed...
GHSA-49Q7-C7J4-3P7M Elliptic allows BER-encoded signatures
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed...
CVE-2024-42460
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero...
CVE-2024-42461
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed...
AZL-47425 CVE-2024-42461 affecting package reaper for versions less than 3.1.1-11
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed...
AZL-47430 CVE-2024-42460 affecting package reaper for versions less than 3.1.1-11
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero...
DEBIAN-CVE-2024-42460
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero...
UBUNTU-CVE-2024-42460
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero...
CVE-2024-42460
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero...
CVE-2024-42461
CVE-2024-42461 : In the Node.js Elliptic package v6.5.6, an ECDSA signature malleability vulnerability exists because BER-encoded signatures are allowed. The connected IBM page lists the issue and confirms a CVSS v3.1 base score of 5.3 (confidentiality: Low, integrity: None, availability: None). ...
