671 matches found
PT-2026-20648
A flaw was found in the blst cryptographic library. This out-of-bounds stack write vulnerability, specifically in the blst sha256 bcopy assembly routine, occurs due to a missing zero-length guard. A remote attacker can exploit this by providing a zero-length salt parameter to key generation...
EUVD-2023-48030
EVE Doesn't Measure Config Partition From 2 Fronts...
MiracleLinux 7 : gnutls-3.3.29-8.el7 (AXSA:2019-3543:01)
The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3543:01 advisory. gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls CVE-2018-10844 gnutls: HMAC-SHA-384 vulnerable to...
EUVD-2026-2018
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorith...
CVE-2025-68703
CVE-2025-68703 affects the Jervis library used with Jenkins Job DSL and shared pipelines. Prior to version 2.2, the salt for PBKDF2 is derived from the SHA-256 hash of the passphrase, causing two encryption operations using the same password to yield the same derived key. This design enables pre-...
GHSA-5PQ9-5MPR-JJ85 Jervis Has a JWT Algorithm Confusion Vulnerability
Vulnerability https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovyL244-L249 The code doesn't validate that the JWT header specifies "alg":"RS256". Impact Depending on the broader system, this could allow JWT...
Jervis Has a SHA-256 Hex String Padding Bug
Vulnerability https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovyL622-L626 padLeft32, '0' should be padLeft64, '0'. SHA-256 produces 32 bytes = 64 hex characters. Impact Inconsistent hash lengths when leadi...
Improper Verification of Cryptographic Signature
Overview jws is an Implementation of JSON Web Signatures Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the createVerify function when using HS256 HMAC algorithms and incorporating user-provided data from the JSON Web Signature Protected...
auth0/node-jws Improperly Verifies HMAC Signature
Overview An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions. Am I Affected? You are affected by this vulnerability if you meet all of the following preconditions: 1. Application uses the auth0/node-jws implementatio...
Command Injection
Overview cli-onprem is a CLI tool for infrastructure engineers Affected versions of this package are vulnerable to Command Injection due to the use of shell-invoked subprocess calls with unvalidated input. An attacker can execute arbitrary commands by injecting shell metacharacters in the directo...
EUVD-2019-3811
Malware in sbrugna...
EUVD-2021-13177
Malware in sbrugna...
EUVD-2024-3454
Malicious code in bioql PyPI...
EUVD-2022-4111
Malicious code in bioql PyPI...
EUVD-2025-11262
Malicious code in bioql PyPI...
EUVD-2023-3035
Malicious code in bioql PyPI...
EUVD-2022-25084
Malicious code in bioql PyPI...
EUVD-2024-45935
Malicious code in bioql PyPI...
Malicious code in sha256-validation-nextjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3290610bb31bf5689be7241b664ae5eb52b47b834fff3e2597c5ab75d88c4bec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in sha256-validation-xyz (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d087a7f065c7d1c6612320e8fc3d19957b0768a27ea56d1c6849c32193941829 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...