122 matches found
CVE-2024-25714
In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. The fix uses gnutlsmemcmp, which has constant-time execution...
CVE-2024-25714
CVE-2024-25714 affects Rhonabwy up to 1.1.13. The HMAC signature verification uses a strcmp-based comparison that can leak timing information via a side-channel, as it stops at the first difference. The documented fix replaces this with a constant-time function (gnutls_memcmp). No exploitation de...
Authentication Bypass
Overview Affected versions of this package are vulnerable to Authentication Bypass due to the insecure use of strcmp. Remediation There is no fixed version for libjwt. References - Report - Vulnerable Code Credit: P3ngu1nW...
JWT C Library Security Vulnerability
JWT C Library is a JWT C library open source by Ben Collins. A security vulnerability exists in JWT C Library version 1.15.3, which stems from the use of strcmp to authenticate, resulting in an authentication bypass vulnerability...
PHP-JWT Security Vulnerability
PHP-JWT is a simple library for encoding and decoding JSON Web Tokens JWT in PHP, compliant with RFC 7519. A security vulnerability exists in PHP-JWT version 1.0.0, which stems from the use of strcmp to authenticate, resulting in an authentication bypass vulnerability...
CVE-2024-25191: Observable Discrepancy
php-jwt 1.0.0 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
CVE-2024-25189: Observable Discrepancy
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
CVE-2024-25189
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
CVE-2024-23771: Observable Discrepancy
darkhttpd before 1.15 uses strcmp which is not constant time to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel...
kernel: ASoC: pxa: fix null-pointer dereference in filter()
A flaw was found in the Linux kernel ASoC pxa audio driver. The function filter used kasprintf to allocate a formatted string but did not check whether the allocation succeeded before passing the result to strcmp. If memory allocation fails and kasprintf returns NULL, this results in a NULL point...
The vulnerability in the strcmp() function of the httpd daemon of the microprogrammed router software for TP-Link Archer C5 version 2 and TP-Link WR710N version 1 allows a hacker to gain unauthorized access to protected information.
The vulnerability of the strcmp function in the httpd daemon of TP-Link Archer C5 version 2 and TP-Link WR710N version 1 is related to the creation of a secondary synchronization channel due to time differences. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...
CVE-2022-4499
TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password...
CVE-2022-4499 The strcmp function in TP-Link routers, Archer C5 and WR710N-V1, used for checking credentials in httpd, is susceptible to a side-channel attack.
TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password...
httpd: Out-of-bounds read in ap_strcmp_match()
An out-of-bounds read vulnerability was found in httpd. A very large input to the apstrcmpmatch function can lead to an integer overflow and result in an out-of-bounds read...
The vulnerability of the ap_strcmp_match() function in the Apache HTTP Server allows a hacker to cause a service failure or gain unauthorized access to protected information.
The vulnerability of the apstrcmpmatch function in the Apache HTTP Server is related to integer overflow. Exploiting this vulnerability could allow a remote attacker to cause service failures or gain unauthorized access to protected information by sending a specially crafted HTTP request...
CVE-2021-30485
An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxmlinternaldtd, while parsing a crafted XML file, performs incorrect memory handling, leading to a NULL pointer dereference while running strcmp on a NULL pointer...
None in fcambus/logswan
Description Good morning, I hope you're doing well today. Whilst testing logswan built with Clang12 + ASan on Ubuntu 20.04.3 LTS from commit bcfd41, we discovered a heap-use-after-free situation during a strcmp operation on line 259 of logswan/src/logswan.c. Proof of Concept First... echo...
CVE-2021-33582: Inefficient Algorithmic Complexity
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service multiple-minute daemon hang via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16...
Microsoft Discloses Critical Bugs Allowing Takeover of NETGEAR Routers
Cybersecurity researchers have detailed critical security vulnerabilities affecting NETGEAR DGN2200v1 series routers, which they say could be reliably abused as a jumping-off point to compromise a network's security and gain unfettered access. The three HTTPd authentication security weaknesses CV...
