Information disclosure

RSA BSAFE Crypto-C Micro Edition versions prior to 4.1.4 and RSA Micro Edition Suite versions prior to 4.4 are vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of...

Information disclosure

RSA BSAFE Crypto-C Micro Edition, versions prior to 4.0.5.3 in 4.0.x and versions prior to 4.1.3.3 in 4.1.x, and RSA Micro Edition Suite, versions prior to 4.0.11 in 4.0.x versions prior to 4.1.6.1 in 4.1.x and versions prior to 4.3.3 4.2.x and 4.3.x are vulnerable to an Information Exposure...

CVE-2019-3732

CVE-2019-3732 affects Dell RSA BSAFE Crypto-C Micro Edition (pre-4.0.5.3 in 4.0.x and pre-4.1.3.3 in 4.1.x) and Dell RSA BSAFE Micro Edition Suite (pre-4.0.11 in 4.0.x, pre-4.1.6.1 in 4.1.x, pre-4.3.3 in 4.2.x/4.3.x). The vulnerability is an Information Disclosure Through Timing Discrepancy, allo...

CVE-2019-3731

The CVE-2019-3731 entry affects Dell RSA BSAFE Crypto-C Micro Edition and RSA Micro Edition Suite. Affected versions are Crypto-C Micro Edition before 4.1.4 and Micro Edition Suite before 4.4. The issue is an Information Disclosure Through Timing Discrepancy, enabling a remote attacker to potenti...

CVE-2019-3731

RSA BSAFE Crypto-C Micro Edition versions prior to 4.1.4 and RSA Micro Edition Suite versions prior to 4.4 are vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of...

CVE-2019-3732

RSA BSAFE Crypto-C Micro Edition, versions prior to 4.0.5.3 in 4.0.x and versions prior to 4.1.3.3 in 4.1.x, and RSA Micro Edition Suite, versions prior to 4.0.11 in 4.0.x versions prior to 4.1.6.1 in 4.1.x and versions prior to 4.3.3 4.2.x and 4.3.x are vulnerable to an Information Exposure...

CVE-2019-3740

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys...

Information disclosure

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys...

Information disclosure

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys...

CVE-2019-3739

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys...

CVE-2019-3739

CVE-2019-3739 concerns RSA BSAFE Crypto-J versions prior to 6.2.5, where information exposure can occur via timing discrepancy during ECDSA key generation. The vulnerability could allow a remote attacker to recover ECDSA keys. The provided documents identify the affected component as Dell/Certico...

CVE-2019-3740

CVE-2019-3740 concerns RSA BSAFE Crypto-J used by Oracle GoldenGate Install (Dell BSAFE Crypto-J). The root cause is a timing-discrepancy vulnerability during DSA key generation that could allow a remote attacker to recover DSA private keys. Affected product/component: Oracle GoldenGate (Install ...

CVE-2019-3740

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys...

Side channel timing attacks against (EC)DSA in RSA BSAFE CVE-2019-3739/CVE-2019-3740 - Project Wycheproof is the AFL for Cryptography

About a year ago I wrote this tweet and now I can finally justify it Project Wycheproof https://t.co/wBz9P8atHs is the AFL https://t.co/JM2l557PZi of crypto. Thanks a lot @XorNinja and team notably including Bleichenbacher for providing such a powerful tool — Antonio Sanso @asanso April 9, 2018 i...

FreeBSD : Gitlab -- Multiple vulnerabilities (da459dbc-5586-11e9-abd6-001b217b3468)

Gitlab reports : DoS potential for regex in CI/CD refs Related branches visible in issues for guests Persistent XSS at merge request resolve conflicts Improper authorization control 'move issue' Guest users of private projects have access to releases DoS potential on project languages page Recuri...

Gitlab -- Multiple vulnerabilities

Gitlab reports: DoS potential for regex in CI/CD refs Related branches visible in issues for guests Persistent XSS at merge request resolve conflicts Improper authorization control "move issue" Guest users of private projects have access to releases DoS potential on project languages page Recurit...

Design/Logic Flaw

Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in Password reset code -- web/reset/index.php, line 51 that can result in Possible to determine password...

CVE-2018-1000884

Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in Password reset code -- web/reset/index.php, line 51 that can result in Possible to determine password...

CVE-2018-1000884

CVE-2018-1000884 affects Vesta CP prior to 0.9.8-18, where the password reset code in web/reset/index.php (line 51) exposes information due to a timing discrepancy (CWE-208). This can allow an attacker, via unauthenticated network access, to determine password reset codes and potentially change t...

CPU hardware utilizing speculative execution may be vulnerable to cache side-channel attacks

Overview CPU hardware utilizing speculative execution may be vulnerable to cache timing side-channel analysis. Two vulnerabilities are identified, known as "Variant 3a" and "Variant 4". Description Speculative execution is a technique used by many modern processors to improve performance by...