26822 matches found
kernel: x86/sev: Make enc_dec_hypercall() accept a size instead of npages
In the Linux kernel, the following vulnerability has been resolved: x86/sev: Make encdechypercall accept a size instead of npages encdechypercall accepted a page count instead of a size, which forced its callers to round up. As a result, non-page aligned vaddrs caused pages to be spuriously marke...
CVE-2023-4421
The NSS code used for checking PKCS1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected...
Sensitive Information Disclosure
github.com/treeverse/lakefs is vulnerable to Sensitive Information Disclosure. The application fails to obfuscate or encrypt the S3 token, revealing it in plaintext logs...
The vulnerability of Siemens SCALANCE industrial switches’ SSH server allows a hacker to execute a “man-in-the-middle” attack.
The vulnerability of Siemens SCALANCE industrial switches’ SSH server is related to insufficient encryption strength. Exploiting this vulnerability allows a remote attacker to execute a “man-in-the-middle” attack...
Timing side-channel in PKCS#1 v1.5 decryption depadding code — Mozilla
The NSS code used for checking PKCS1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected...
Security Bulletin: Multiple vulnerabilities in cURL libcurl affect AIX
Summary Multiple vulnerabilities in cURL libcurl affect AIX. AIX uses cURL libcurl as part of LV/PV encryption integration with HPCS and in Live Update for interacting with HMC. Vulnerability Details CVEID:CVE-2023-38546 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security...
Multiple vulnerabilities in cURL libcurl affect AIX
IBM SECURITY ADVISORY First Issued: Mon Dec 11 13:22:02 CST 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/curladvisory3.asc Security Bulletin: Multiple vulnerabilities in cURL libcurl affect AIX...
Facebook Enables Messenger End-to-End Encryption by Default
Its happened. Details here, and tech details here for messages in transit and here for messages in storage Rollout to everyone will take months, but its a good day for both privacy and security. Slashdot thread...
Douglas-042 - Powershell Script To Help Speed Up Threat Hunting Incident Response Processes
DOUGLAS-042 stands as an ingenious embodiment of a PowerShell script meticulously designed to expedite the triage process and facilitate the meticulous collection of crucial evidence derived from both forensic artifacts and the ephemeral landscape of volatile data. Its fundamental mission revolve...
The vulnerability of the Acer Wireless Keyboard SK-9662 lies in the insufficient security of its data encryption. This allows a hacker to decode keyboard inputs or insert arbitrary keystrokes.
The vulnerability of the Acer Wireless Keyboard SK-9662 relates to insufficiently secure data encryption. Exploiting this vulnerability allows a malicious actor to decode keyboard inputs or insert arbitrary keystrokes remotely...
Fedora 38 : bluez (2023-26a02512e1)
The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-26a02512e1 advisory. Install default input.conf/network.conf Add mitigation for CVE-2023-45866 Tenable has extracted the preceding description block directly from the Fedora...
Ransomware-as-a-Service: The Growing Threat You Can't Ignore
Ransomware attacks have become a significant and pervasive threat in the ever-evolving realm of cybersecurity. Among the various iterations of ransomware, one trend that has gained prominence is Ransomware-as-a-Service RaaS. This alarming development has transformed the cybercrime landscape,...
Insufficient Entropy
pubnub is vulnerable to Insufficient Entropy. The vulnerability is caused by the getKey function in web.js which uses an inefficient key derivation method for AES-256-CBC encryption, resulting in a reduced key space due to hex encoding and trimming. This leaves half of the bits in the encryption...
Missing Encryption Of Sensitive Data
curl is vulnerable to Missing Encryption of Sensitive Data. The vulnerability is due to When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use...
CVE-2023-45866
CVE-2023-45866 affects BlueZ Bluetooth HID Hosts. The description states that an unauthenticated Peripheral role HID Device could initiate, establish an encrypted connection, and send HID keyboard reports, potentially injecting HID messages when there is no user interaction in the Central role to...
postgresql: Client memory disclosure when connecting with Kerberos to modified server
A flaw was found In PostgreSQL. A modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions, a server can cause a libpq client to over-read and report an error message containing uninitialized bytes...
postgresql: Client memory disclosure when connecting with Kerberos to modified server
A flaw was found In PostgreSQL. A modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions, a server can cause a libpq client to over-read and report an error message containing uninitialized bytes...
Meta Launches Default End-to-End Encryption for Chats and Calls on Messenger
Meta has officially begun to roll out support for end-to-end encryption E2EE in Messenger for personal calls and one-to-one personal messages by default in what it called the "most significant milestone yet." "This isn't a routine security update: we rebuilt the app from the ground up, in close...
Denial Of Service (DoS)
lestrrat-go/jwx is vulnerable to Denial Of Service DoS. The vulnerability is due to a lack of size limitation for the p2c parameter used in PBKDF2 based encryptions, which allows an attacker to cause DoS if the p2c is set too high...
GHSA-5844-Q3FC-56RH pubnub Insufficient Entropy vulnerability
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0;...