657 matches found
CVE-2026-30790
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-30790
CVE-2026-30790 is rejected per the Initial Description.
PT-2026-23456
Name of the Vulnerable Software and Affected Versions RustDesk Server Pro versions through 1.7.5 RustDesk Server OSS versions through 1.1.15 Description The software contains a flaw related to insufficient restriction of excessive authentication attempts and the use of a password hash with...
ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation
Impact The RSASHA256Algorithm and RSASHA1Algorithm contracts fail to validate PKCS1 v1.5 padding structure when verifying RSA signatures. The contracts only check if the last 32 or 20 bytes of the decrypted signature match the expected hash. This enables Bleichenbacher's 2006 signature forgery...
CVE-2026-2681 Github.com/supranational/blst: blst cryptographic library: denial of service via out-of-bounds stack write in key generation
A flaw was found in the blst cryptographic library. This out-of-bounds stack write vulnerability, specifically in the blstsha256bcopy assembly routine, occurs due to a missing zero-length guard. A remote attacker can exploit this by providing a zero-length salt parameter to key generation...
CVE-2026-2681
The CVE-2026-2681 entry concerns the blst cryptographic library. The vulnerability is an out-of-bounds stack write in the blst_sha256_bcopy assembly routine caused by a missing zero-length guard. A remote attacker could exploit this by supplying a zero-length salt to key generation functions (e.g...
PT-2026-20648
A flaw was found in the blst cryptographic library. This out-of-bounds stack write vulnerability, specifically in the blst sha256 bcopy assembly routine, occurs due to a missing zero-length guard. A remote attacker can exploit this by providing a zero-length salt parameter to key generation...
EUVD-2023-48030
EVE Doesn't Measure Config Partition From 2 Fronts...
MiracleLinux 7 : gnutls-3.3.29-8.el7 (AXSA:2019-3543:01)
The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3543:01 advisory. gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls CVE-2018-10844 gnutls: HMAC-SHA-384 vulnerable to...
EUVD-2026-2018
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorith...
CVE-2025-68703
CVE-2025-68703 affects the Jervis library used with Jenkins Job DSL and shared pipelines. Prior to version 2.2, the salt for PBKDF2 is derived from the SHA-256 hash of the passphrase, causing two encryption operations using the same password to yield the same derived key. This design enables pre-...
GHSA-5PQ9-5MPR-JJ85 Jervis Has a JWT Algorithm Confusion Vulnerability
Vulnerability https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovyL244-L249 The code doesn't validate that the JWT header specifies "alg":"RS256". Impact Depending on the broader system, this could allow JWT...
Jervis Has a SHA-256 Hex String Padding Bug
Vulnerability https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovyL622-L626 padLeft32, '0' should be padLeft64, '0'. SHA-256 produces 32 bytes = 64 hex characters. Impact Inconsistent hash lengths when leadi...
Improper Verification of Cryptographic Signature
Overview jws is an Implementation of JSON Web Signatures Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the createVerify function when using HS256 HMAC algorithms and incorporating user-provided data from the JSON Web Signature Protected...
auth0/node-jws Improperly Verifies HMAC Signature
Overview An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions. Am I Affected? You are affected by this vulnerability if you meet all of the following preconditions: 1. Application uses the auth0/node-jws implementatio...
Command Injection
Overview cli-onprem is a CLI tool for infrastructure engineers Affected versions of this package are vulnerable to Command Injection due to the use of shell-invoked subprocess calls with unvalidated input. An attacker can execute arbitrary commands by injecting shell metacharacters in the directo...
EUVD-2021-13177
Malware in sbrugna...
EUVD-2019-3811
Malware in sbrugna...