CVE-2026-8794

CVE-2026-8794 — Enumerazione degli Username tramite Canale Laterale di Temporizzazione nell'Autenticazione di PaperCut NG Campo| Dettagli ---|--- ID CVE| CVE-2026-8794 Prodotto| PaperCut NG Versione interessata| 25.0.11 Build 75758 e precedenti CWE| CWE-208 — Discrepanza di Temporizzazione...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

EUVD-2026-67168

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2023-1206-CVE-2025-40040-CVE-2024-49882

Canale Nascosto Combinato: CVE-2023-1206 + CVE-2024-49882 Panoramica Questo progetto dimostra un canale di comunicazione nascosto che utilizza due vulnerabilità del kernel Linux: Componente| CVE| Scopo ---|---|--- Canale di Sincronizzazione| CVE-2023-1206| Sincronizzazione dell'orologio tramite...

AVX-Side-Channel

AVX 기반 타이밍 부채널 — ASLR 탐지 저자: Byte Reaper 설명 AVX 메모리 로드 + RDTSCP 타이밍 및 선택적 SIGSEGV 탐지를 사용하여 ASLR 탐지를 시연하는 스크립트입니다. 요구 사항 : Linux x8664 -mavx2를 지원하는 GCC AVX2 및 RDTSCP를 지원하는 CPU 빌드 : root@kitploit: gcc -mavx2 -O2 file.c -o AVX-Side-Channel ./AVX-Side-Channel 빠른 출력 예시 빠른 접근 → ASLR not detected 느린 접근 ...

ssh-enum

ssh-enum Studio di convalida statistica di CVE-2016-6210 Una ri-indagine riproducibile dell'enumerazione degli username OpenSSH utilizzando l'analisi statistica. Questo progetto riesamina CVE-2016-6210 , un side-channel temporale documentato di OpenSSH, per determinare se rimane osservabile su un...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – Side-Channel temporale del KEM post-quantistico decapsulazione Kyber Panoramica Un'implementazione vulnerabile della decapsulazione del KEM Kyber perde bit della chiave segreta attraverso differenze di temporizzazione nella fase di rifiuto del ciphertext, consentendo il recuper...

EUVD-2026-65214

The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hashequals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...

CVE-2026-53525

A flaw was found in WeeChat, a free chat client. The relay authentication mechanism uses a non-constant-time comparison when verifying password hashes. This vulnerability allows a remote attacker to exploit subtle timing differences during the authentication process. By analyzing these timing...

Vulnerabilities of the functions tcp_inbound_md5_hash(), tcp_v4_send_reset(), and tcp_v6_send_reset() in the Linux operating system, which allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of the functions tcpinboundmd5hash, tcpv4sendreset, and tcpv6sendreset in the Linux operating system are related to the disclosure of information due to the observed difference in execution time. Exploiting these vulnerabilities can allow a remote attacker to compromise the...

CVE-2026-75589

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

UBUNTU-CVE-2026-75589

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

CVE-2026-44255 Wazuh: Username Enumeration via Timing Side-Channel

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.checkuser in framework/wazuh/rbac/orm.py performs checkpasswordhash only when the supplied username exists. A nonexistent username returns...

CVE-2026-59502

: Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-16458

The CVE concerns Oberon microsystem AG’s ocrypto library, affected in all versions since 3.0.0 and before 4.0.1. The issue is a padding oracle/timing side-channel flaw in RSA PKCS#1 v1.5 decryption that enables an attacker with local access to recover plaintexts by measuring decryption timing. Th...

CVE-2026-16458 Timing side-channel in RSA PKCS#1 v1.5 decryption in ocrypto

Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...

CVE-2026-16459 Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto

Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS1 v1.5 decrypt operations...

CVE-2026-16459

CVE-2026-16459 : Padding oracle timing side-channel vulnerability in Oberon Microsystems’ Oberon PSA Crypto library. All versions from 1.0.0 up to, but not including, 2.1.1 are affected. An attacker can recover plaintexts by measuring execution time during RSA PKCS#1 v1.5 decryption. The public d...