74 matches found
EUVD-2022-33466
Malicious code in bioql PyPI...
EUVD-2024-33719
Malicious code in bioql PyPI...
CVE-2025-52373
Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini config file...
CVE-2024-50564
A use of hard-coded cryptographic key in Fortinet FortiClientWindows version 7.4.0, 7.2.x all versions, 7.0.x all versions, and 6.4.x all versions may allow a low-privileged user to decrypt interprocess communication via monitoring named piped...
OESA-2024-1729 iperf3 security update
Iperf is a tool for active measurements of the maximum achievable bandwidth on IP networks. It supports tuning of various parameters related to timing, protocols, and buffers. Security Fixes: iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a...
CVE-2023-26306
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of message...
iPerf3 security vulnerabilities
iPerf3 is an ESnet open source tool for actively measuring the maximum achievable bandwidth on an IP network. A security vulnerability exists in iPerf3 versions prior to 3.17 that stems from allowing the use of a timed side channel in an RSA decryption operation, which could allow an attacker to...
kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation
A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt ciphertexts or forge signatures, limiting the services that use that private key...
PT-2024-2706
Name of the Vulnerable Software and Affected Versions: Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched Description: The issue is related to the use of hidden side channels in the PrivateDecrypt function of th...
CVE-2023-49944: Undefined Security Weakness
The Challenge Response feature of BeyondTrust Privilege Management for Windows PMfW before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature...
PT-2023-8446
Name of the Vulnerable Software and Affected Versions jsrsasign versions prior to 11.0.0 Description The issue is related to an Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process in the jsrsasign package. An attacker can decrypt ciphertexts by exploiting this flaw, which is...
SUSE CVE-2021-3711
In order to decrypt SM2 encrypted data an application is expected to call the API function EVPPKEYdecrypt. Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size...
CVE-2022-2031
A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other...
Mitsubishi Electric MELSEC iQ-F series encryption vulnerabilities
Mitsubishi Electric Automation China Co., Ltd. is a wholly-owned enterprise in China invested by Mitsubishi Electric Corporation. It mainly produces mechanical appliances for power distribution including low-voltage circuit breakers, electromagnetic openers and closers, electrical processing...
Nettle RSA Decryption DoS
The vulnerability of RSA decryption functions in the Nettle cryptographic library is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service failures using specially created ciphertext...
OpenSSL SM2 Code Execution
The vulnerability of the implementation of the SM2 cryptographic algorithm in the OpenSSL library lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by transmitting specially crafted data for...
ALPINE-CVE-2021-3711
In order to decrypt SM2 encrypted data an application is expected to call the API function EVPPKEYdecrypt. Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size...
DEBIAN-CVE-2021-34813
Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client while it is attempting to retrieve an Olm encrypted room key backup from the homeserver because olmpkdecrypt has a stack-based buffer overflow. Remote code execution might be possible for some nonstandard build...
Linux Nettle: Input validation vulnerability
Linux Nettle is an American open source application for Linux. Contains a design that lends itself easily to a low-level cryptographic library in many cases. An input validation error vulnerability exists in Linux Nettle, which stems from the way the RSA decryption function improperly handles...
PT-2021-5781
Name of the Vulnerable Software and Affected Versions Nettle affected versions not specified Description A flaw was found in the way Nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application...