Ubuntu 22.04 LTS / 24.04 LTS / 25.04 : Request Tracker vulnerabilities (USN-7692-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7692-1 advisory. It was discovered that Request Tracker was susceptible to timing attacks. An attacker could possibly use this issue to access sensiti...

PT-2025-46761

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s SCTP implementation related to Message Authentication Code MAC comparison. The MAC comparison was not performed in constant time, potentially allowing...

Linux Distros Unpatched Vulnerability : CVE-2024-45192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Matrix libolm through 3.2.16. Cache-timing attacks can occur due to use of base64 when decoding group session keys. This refers to th...

Linux Distros Unpatched Vulnerability : CVE-2022-45416

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Keyboard events reference strings like KeyA that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have...

USN-7692-1 request-tracker5 vulnerabilities

It was discovered that Request Tracker was susceptible to timing attacks. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 22.04 LTS. CVE-2021-38562 It was discovered that Request Tracker was susceptible to cross-site scripting attacks whe...

SUSE CVE-2025-54999

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users an...

Username Enumeration

github.com/openbao/openbao is vulnerable to user enumeration. The vulnerability is due to timing differences in the userpass authentication method between non-existent users and users with stored credentials, which allows an attacker to enumerate valid usernames regardless of password validity...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the pathLogin function in the userpass/pathlogin.go file. An attacker can determine whether a username exists by measuring the response time difference between authentication attempts for existing and non-existi...

CVE-2025-54999 OpenBao: Timing Side-Channel in Userpass Auth Method

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users an...

Linux Distros Unpatched Vulnerability : CVE-2022-31742

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles a...

Linux Distros Unpatched Vulnerability : CVE-2019-9815

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to...

Security Bulletin: IBM i is affected by a timing attack, handling signals in an unsafe manner, and uncontrolled memory consumption due to vulnerabilities in OpenSSH [CVE-2024-39894, CVE-2024-6387, CVE-2025-26466].

Summary OpenSSH used by IBM i is affected by a timing attack against password entry, handling signals in an unsafe manner, and an uncontrolled increase in memory consumption as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerabilitie...

GLSA-202508-04 : Mozilla Network Security Service (NSS): TLS RSA decryption timing attack

The remote host is affected by the vulnerability described in GLSA-202508-04 Mozilla Network Security Service NSS: TLS RSA decryption timing attack A vulnerability has been discovered in Mozilla Network Security Service NSS. Please review the CVE identifier referenced below for details. Tenable h...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via pathLogin. An attacker can determine whether a username exists by measuring response times. Remediation Upgrade github.com/hashicorp/vault/builtin/credential/userpass to version 1.20.1 or higher. References - GitHub...

CVE-2025-53940

Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for tok...

CVE-2025-53940

Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for tok...

CVE-2025-53940 Quiet uses insecure, inconsistent verification on local backend token

Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for tok...

CVE-2025-53940 Quiet uses insecure, inconsistent verification on local backend token

Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for tok...

CVE-2025-53940

CVE-2025-53940 affects Quiet, an open-source p2p chat alternative. Vulnerable in Quiet 6.1.0-alpha.4 and earlier due to an insecure, non-constant-time token verification comparison in the backend/frontend API, enabling a timing attack to guess the token character by character. The issue is resolv...

CVE-2025-53940 Quiet uses insecure, inconsistent verification on local backend token

Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for tok...