`ed25519-dalek` Double Public Key Signing Function Oracle Attack

Versions of ed25519-dalek prior to v2.0 model private and public keys as separate types which can be assembled into a Keypair, and also provide APIs for serializing and deserializing 64-byte private/public keypairs. Such APIs and serializations are inherently unsafe as the public key is one of th...

GHSA-W5VR-6QHR-36CC `ed25519-dalek` Double Public Key Signing Function Oracle Attack

Versions of ed25519-dalek prior to v2.0 model private and public keys as separate types which can be assembled into a Keypair, and also provide APIs for serializing and deserializing 64-byte private/public keypairs. Such APIs and serializations are inherently unsafe as the public key is one of th...

CVE-2023-39395

Mismatch vulnerability in the serialization process in the communication system. Successful exploitation of this vulnerability may affect availability...

CVE-2023-39395

Mismatch vulnerability in the serialization process in the communication system. Successful exploitation of this vulnerability may affect availability...

Code injection

Mismatch vulnerability in the serialization process in the communication system. Successful exploitation of this vulnerability may affect availability...

CVE-2023-39395

Mismatch vulnerability in the serialization process in the communication system. Successful exploitation of this vulnerability may affect availability...

CVE-2023-39395

Technical details about CVE-2023-39395 are not publicly available in the provided documents. Monitor for official advisories; current descriptions only indicate a serialization mismatch potentially affecting availability, with no concrete affected products or remediation details disclosed here.

CVE-2023-39395

Mismatch vulnerability in the serialization process in the communication system. Successful exploitation of this vulnerability may affect availability...

PT-2023-26923 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a mismatch vulnerability in the serialization process within the communication system. Successful exploitation of this...

CVE-2023-39395: Undefined Security Weakness

Mismatch vulnerability in the serialization process in the communication system. Successful exploitation of this vulnerability may affect availability...

spring-boot:ConfigurationMetadataRepositoryJsonBuilderFuzzer: Security exception in org.json.JSONArray.writeTo

Detailed Report: https://oss-fuzz.com/testcase?key=4867254330982400 Project: spring-boot Fuzzing Engine: libFuzzer Fuzz Target: ConfigurationMetadataRepositoryJsonBuilderFuzzer Job Type: libfuzzerasanspring-boot Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

PT-2023-4337 · Inductive Automation · Inductive Automation Ignition

Name of the Vulnerable Software and Affected Versions: Inductive Automation Ignition affected versions not specified Description: The issue is related to errors in data serialization within the JavaSerializationCodec class of Inductive Automation Ignition. This allows remote attackers to execute...

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode

A flaw was found in Jackson Databind. This issue may allow a malicious user to cause a denial of service 2 GB transient heap usage per read in uncommon situations involving JsonNode JDK serialization...

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode

A flaw was found in Jackson Databind. This issue may allow a malicious user to cause a denial of service 2 GB transient heap usage per read in uncommon situations involving JsonNode JDK serialization...

RHEL 9 : Red Hat JBoss Enterprise Application Platform (RHSA-2023:4507)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4507 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

AlmaLinux 9 : java-1.8.0-openjdk (ALSA-2023:0210)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0210 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are...

CVE-2023-20862

A flaw was found in Spring Security. In affected versions of Spring Security, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. Th...

org.apache.nifi.minifi:minifi-assembly (1.22.0), org.apache.nifi:nifi-record-serialization-services-nar (>=1.2.0, <=1.22.0) +6 more potentially affected by CVE-2023-36542 via org.apache.nifi:nifi-record-serialization-services (>=1.2.0, <=1.22.0)

org.apache.nifi:nifi-record-serialization-services MAVEN version =1.2.0, =1.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.2, =0.2.3 Source cves: CVE-2023-36542 Source advisory: OSV:GHSA-R969-8V3H-23V9...

org.apache.nifi.minifi:minifi-assembly (1.22.0), org.apache.nifi:nifi-record-serialization-services-nar (>=1.2.0, <=1.22.0) +6 more potentially affected by CVE-2023-36542 via org.apache.nifi:nifi-record-serialization-services (>=1.2.0, <=1.22.0)

org.apache.nifi:nifi-record-serialization-services MAVEN version =1.2.0, =1.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.2, =0.2.3 Source cves: CVE-2023-36542 Source advisory: GHSA-R969-8V3H-23V9...

org.apache.nifi.minifi:minifi-assembly (1.22.0), org.apache.nifi:nifi-record-serialization-services-nar (>=1.2.0, <=1.22.0) +6 more potentially affected by CVE-2023-36542 via org.apache.nifi:nifi-record-serialization-services (>=1.2.0, <=1.22.0)

org.apache.nifi:nifi-record-serialization-services MAVEN version =1.2.0, =1.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.2, =0.2.3 Source cves: CVE-2023-36542 Source advisory: MEND:CVE-2023-36542...