VaultPress 1.89-1.9 - Unauthenticated RCE

The builtin WAF must be disabled or bypassed for successful exploitation. v1.89 - Improper usage of opensslverify - signature compare - timing attack unsafe v1.9 - signature compare - timing attack unsafe...

Timing Attack

craftcms/cms is vulnerable to timing attack. The application uses the strcmp function that compares hashes in non-constant time, allowing an attacker to use the timing of the request to progressively identify the current PHP session id...

Timing Attack

drupal/core is vulnerable to timing attacks. The library is vulnerable because it does not compare CSRF tokens with a constant time string comparison which allows malicious users to use the timing of the request to progressively identify a valid CSRF token...

EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2017-1191)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to...

EulerOS 2.0 SP2 : authconfig (EulerOS-SA-2017-1196)

According to the version of the authconfig packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found where authconfig could configure sssd in a way that treats existing and non-existing logins differently, leaking information o...

EulerOS 2.0 SP1 : authconfig (EulerOS-SA-2017-1195)

According to the version of the authconfig packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found where authconfig could configure sssd in a way that treats existing and non-existing logins differently, leaking information o...

Das U-Boot AES-CBC encryption implementation contains multiple vulnerabilities

Overview Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector and improper handling of an error condition may allow attacks against the underlying...

CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

CVE-2015-3250

CVE-2015-3250 affects the Apache Directory LDAP API prior to 1.0.0-M31. The vulnerability allows timing attacks via unspecified vectors. This is consistently described across multiple sources (GHSA, NVD, OSV, Ubuntu/Debian OSV), though exploitation details and remediation are not provided in the ...

CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

Timing Attack

automattic/jetpack is vulnerable to timing attacks. This vulnerability is caused because the secrets are not compared in constant time, allowing malicious users to guess the valid secrets based on the time that a comparison takes...

Timing Attack

automattic/jetpack is vulnerable to timing attacks. This vulnerability is caused because the signatures are not compared in constant time, allowing malicious users to guess the valid signatures based on the time that a comparison takes...

Timing Attack

jetpack is vulnerable to timing attacks. This vulnerability is caused because the HMAC hashes are not compared in constant time, allowing malicious users to guess the valid HMAC hashes based on the time that a comparison takes...

CVE-2017-12872

The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...

CVE-2017-12872

The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...

UBUNTU-CVE-2017-12872

The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...

Medium: authconfig

Issue Overview: Information leak when SSSD is used for authentication against remote server: A flaw was found where authconfig could configure sssd in a way that treats existing and non-existing logins differently, leaking information on existence of a user. An attacker with physical or network...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.4.5 security update

An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...