73 matches found
about-hmac
О HMAC Пример реализации базового HMAC Hash-based Message Authentication Code с использованием Flask на Python. Что такое HMAC?! Hash-based message authentication code HMAC предоставляет серверу и клиенту закрытый ключ, известный только данному конкретному серверу и данному конкретному клиенту...
CVE-2026-89701
A flaw was found in the Linux kernel's Network File System Daemon nfsd. The TIMEDELEGACCESS and TIMEDELEGMODIFY decode paths do not properly validate the nanosecond nseconds value in timestamps. This allows a remote attacker to provide a malformed timestamp, which can then be written to disk,...
CVE-2026-89666 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...
CVE-2026-53636
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...
EUVD-2026-70222
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...
CVE-2026-53636 Open edX LTI OAuth Replay Attack
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...
CVE-2026-53636 Open edX LTI OAuth Replay Attack
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...
CVE-2026-53636
The Open edX LMS platform has a replay vulnerability in its LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who capture...
CVE-2026-76245 stigmem Federation Peer Token Timestamp Validation Bypass
stigmem pip package stigmem-node version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using...
CVE-2026-76245 stigmem Federation Peer Token Timestamp Validation Bypass
stigmem pip package stigmem-node version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using...
Linux Distros Unpatched Vulnerability : CVE-2026-54787
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity...
AZL-94425 CVE-2026-54787 affecting package gh for versions less than 2.97.0-1
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...
DEBIAN-CVE-2026-54787
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...
UBUNTU-CVE-2026-54787
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...
CVE-2026-54787 sigstore-go fails to check signature timestamps against a signing key's validity period
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...
EUVD-2026-51359
The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE EtherType 0x88B8 Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bounds read during message processing,...
PT-2026-66634
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The GOOSE subscriber component fails to properly validate the UTC timestamp field in unauthenticated IEC 61850 GOOSE EtherType 0x88B8 Layer-2 multicast messages...
BIT-KIBANA-2026-33463 Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access
Operation on a Resource after Expiration or Termination CWE-672 in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticate...
stigmem-node's federation peer token timestamp validation may reject valid peer tokens
Impact A mismatch in federation peer-token timestamp handling could cause valid peer tokens to be treated as expired. Impacted deployments are Stigmem nodes using federation peer authentication paths from affected versions. The primary impact is availability and reliability of authenticated...
CVE-2026-33463
Operation on a Resource after Expiration or Termination CWE-672 in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticate...