CVE-2019-10233

Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie...

CVE-2019-10233

Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie...

CVE-2019-10233

Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie...

Design/Logic Flaw

Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie...

CVE-2019-10233

Teclib GLPI before 9.4.1.1 is affected by a timing attack related to a cookie. Affected software is Teclib GLPI; root cause is a timing-based vulnerability in cookie handling. The issue is documented across multiple sources (e.g., CVE-2019-10233) with remediation suggested by the GLPI 9.4.1.1 rel...

CVE-2019-10233

Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie...

openSUSE Security Update : MozillaThunderbird (openSUSE-2019-680)

This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are...

50m-ctf: Weak credentials, Blind SQLi, Timing attack, that leads to web admin access

Summary: Discovery of the application: The h1Thermostat application was discovered by extracting the bit.do URL from the image at https://pbs.twimg.com/media/D0XoThpW0AE2r8S.png:large. The URL https://bit.do/h1therm then led to a Google Drive where the Android application file h1thermostat.apk...

50m-ctf: Several vulnerabilities lead to Remote Code Execution and Arbitraty File Read on multiple servers

Summary: - Tweeted image contained URL https://bit.do/h1therm to download an APK - APK API 35.243.186.41 is vulnerable to SQL Injection on username parameter and leaked location of server 104.196.12.98 through the devices table - Login form on 104.196.12.98 is vulnerable to timing attack on hash...

Low: openssl

Issue Overview: The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. CVE-2018-0734 Affected Packages: openssl Issue Correction: Run yum update openssl or yum updat...

50m-ctf: LFI on Accounting server and RCE on FliteThermostat admin server

Summary: An attacker is able to download local files on the Accounting server due leveraging improper input sanitization in the Invoice PDF generator. In the same fashion an attacker is also able to issue server-side requests on the Accounting server through user-controlled CSS, possibly leading ...

Timing Attack

github.com/youtube/vitess is vulnerable to timing attack. The usage of an insecure password comparison function entry.Password == password in vitess/go/mysql/authserverstatic.go allows a remote attacker to determine a user's password by analyzing the server response. This is due to early aborting...

Timing Attack

github.com/youtube/vitess is vulnerable to timing attack. The use of an insecure String comparison function bytes.Compare in vitess/go/mysql/authserverstatic.go allows a remote attacker to discover users' plaintext passwords by analyzing response time from the server. The attacker will require th...

Design/Logic Flaw

A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation may be able to derive information about the high bits of the secret key, as the function to derive the public point from the secret scalar uses an unblinded...

ALPINE-CVE-2018-20187

A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation may be able to derive information about the high bits of the secret key, as the function to derive the public point from the secret scalar uses an unblinded...

EulerOS Virtualization 2.5.2 : openssl (EulerOS-SA-2019-1084)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with...

Security Bulletin: IBM Security Identity Adapters affected by OpenSSL RSA Key vulnerability (CVE-2018-0737)

Summary The Windows and z/OS Security Identity Adapters are now upgraded to a more current release to correct CVE CVE-2018-0737 "OpenSSL RSA Key generation algorithm information disclosure". Vulnerability Details CVEID: CVE-2018-0737 DESCRIPTION: OpenSSL could allow a local attacker to obtain...

Timing Attack in csrf-lite

Affected versions of csrf-lite are vulnerable to timing attacks as a result of testing CSRF tokens via a fail-early comparison instead of a constant-time comparison. Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback ...

GHSA-HJHR-R3GQ-QVP6 Timing Attack in csrf-lite

Affected versions of csrf-lite are vulnerable to timing attacks as a result of testing CSRF tokens via a fail-early comparison instead of a constant-time comparison. Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback ...

USN-3850-2: NSS vulnerabilities

USN-3850-1 fixed several vulnerabilities in NSS. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perform a cache-timing attack...