235 matches found
FreeBSD : munge -- CWE-787: Out-of-bounds Write (17186409-09d2-11f1-a39c-b42e991fc52e)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 17186409-09d2-11f1-a39c-b42e991fc52e advisory. https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh reports: MUNGE is an authenticatio...
OESA-2026-1348 munge security update
MUNGE MUNGE Uid 'N' Gid Emporium is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having...
CVE-2026-25506 MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery
MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged the MUNGE authentication daemon to leak cryptographic key material from process memory. With the leaked key material, the...
CVE-2026-25506 MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery
MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged the MUNGE authentication daemon to leak cryptographic key material from process memory. With the leaked key material, the...
munge -- CWE-787: Out-of-bounds Write
https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh reports: MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged the MUNGE authentication daemon to leak...
GHSA-HCP2-X6J4-29J7 RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
Summary A timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature. Details The analysis was performed using a constant-time analyzer that examines compiled assembly code for instructions with data-dependent timing...
Improper Verification of Cryptographic Signature
Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the VerifyBundle function in the verify.go file. An attacker can bypass artifact integrity checks by crafting a bundle that includes any arbitrary Rekor entry, allowing successful...
CVE-2019-18193
In Unisys Stealth core 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions. Fixed included in 3.4.109, 4.0.027.13, 4.0.125 and 5.0.013.0...
CVE-2023-43542
Memory corruption while copying a keyblobs material when the key materials size is not accurately checked...
curl: Cross‑Layer State Confusion in libcurl: Credential & Key‑Material Persistence Across Redirect / Connection Reuse Boundaries
Summary: This report describes a state‑level security invariant violation in libcurl where credential‑ or key‑related state may persist or be re‑applied across logical trust boundaries redirects, connection reuse, or scheme transitions without a formal invariant enforcing reset semantics. The iss...
RUSTSEC-2025-0144 Timing side-channel in ML-DSA decomposition
Summary A timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature. Details The analysis was performed using a constant-time analyzer that examines compiled assembly code for instructions with data-dependent timing...
Timing side-channel in ML-DSA decomposition
Summary A timing side-channel was discovered in the Decompose algorithm which is used during ML-DSA signing to generate hints for the signature. Details The analysis was performed using a constant-time analyzer that examines compiled assembly code for instructions with data-dependent timing...
CVE-2025-41744 Sprecher Automation: SPRECON-E series has static default key material for TLS connections
Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity...
EUVD-2020-3552
Malware in sbrugna...
EUVD-2017-9448
Malware in sbrugna...
EUVD-2019-7996
Malware in sbrugna...
EUVD-2020-5206
Malware in sbrugna...
EUVD-2020-6611
Malware in sbrugna...