CVE-2022-47930

CVE-2022-47930 affects IO FinNet tss-lib prior to 2.0.0. The root cause is that the parameter ssid used to define a session id is not applied through the MPC implementation, and the Schnorr proof of knowledge in sch.go does not utilize a session id, context, or random nonce when generating the ch...

CVE-2023-26557

io.finnet tss-lib before 2.0.0 is vulnerable to a timing side-channel that can leak the lambda value of a private key because it uses Go big.Int in non-constant-time operations (Cmp, modular exponentiation, modular inverse). The issue affects tss-lib versions prior to 2.0.0 and is noted for bnb-c...

CVE-2022-47930

An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session...

CVE-2022-47930

An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session...

Observable Discrepancy

io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time there is an if statement in a loop. One leak is in ecdsa/keygen/round2.go. bnb-chain/tss-lib and...

CVE-2022-47930

An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session...

CVE-2023-26557

io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. bnb-chain/tss-lib and...

CVE-2023-26557: Observable Discrepancy

io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. bnb-chain/tss-lib and...

Observable Discrepancy

io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. bnb-chain/tss-lib and...

CVE-2022-4942

A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic. Affected by this issue is the function renderIssue in the library lib/template-generator.js. The manipulation of the argument message leads to cross site scripting. The attack may be launched...

PT-2023-15928 · Mportuga · Eslint-Detailed-Reporter

Name of the Vulnerable Software and Affected Versions: mportuga eslint-detailed-reporter versions up to 0.9.0 Description: A vulnerability was found in the function renderIssue in the library lib/template-generator.js, which can lead to cross-site scripting when the message argument is manipulate...

CVE-2022-4942: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic. Affected by this issue is the function renderIssue in the library lib/template-generator.js. The manipulation of the argument message leads to cross site scripting. The attack may be launched...

PT-2023-36690

Уязвимость функции init amd модуля arch/x86/lib/clear page 64.S ядра операционной системы Linux связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

CVE-2022-37704

Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure...

CVE-2022-45030

A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= this may interact with secure-file-priv...

CVE-2022-45030: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= this may interact with secure-file-priv...

Amazon Linux AMI : emacs (ALAS-2023-1712)

The version of emacs installed on the remote host is prior to 24.3-20.25. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1712 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,...

CVE-2023-26991

SWFTools v0.9.2 was discovered to contain a stack-use-after-scope in the swfReadSWF2 function in lib/rfxswf.c...

Malicious Package

Overview arriva-ui-lib is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

PT-2023-20891 · Swftools · Swftools

Name of the Vulnerable Software and Affected Versions: SWFTools version 0.9.2 Description: A stack-use-after-scope issue was discovered in the swf ReadSWF2 function in lib/rfxswf.c. This issue affects the SWFTools software. Recommendations: For SWFTools version 0.9.2, at the moment, there is no...