syncRewards() after xERC4626's beforeWithdraw() can result in wrong reward amount

Lines of code Vulnerability details Impact The withdrawal amount will be counted as part of the surplus asset balance mistakenly if block.timestamp = rewardsCycleEnd. Proof of Concept function beforeWithdrawuint256 assets, uint256 shares internal override super.beforeWithdrawassets, shares; // ca...

TYPO3 CMS vulnerable to User Enumeration via Response Timing

Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C 4.9 Problem It has been discovered that observing response time during user authentication backend and frontend can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3...

GHSA-M392-235J-9R7R TYPO3 CMS vulnerable to User Enumeration via Response Timing

Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C 4.9 Problem It has been discovered that observing response time during user authentication backend and frontend can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd party TYPO3...

PT-2022-5018 · WordPress · Wp 2Fa

Name of the Vulnerable Software and Affected Versions: WP 2FA WordPress plugin versions prior to 2.3.0 Description: The issue exists due to the use of comparison operators that do not mitigate time-based attacks, potentially allowing a remote attacker to leak information about authentication code...

CVE-2022-36105 User Enumeration via Response Timing in TYPO3

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication backend and frontend can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd part...

CVE-2022-36105 User Enumeration via Response Timing in TYPO3

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication backend and frontend can be used to distinguish between existing and non-existing user accounts. Extension authors of 3rd part...

TYPO3-CORE-SA-2022-007: User Enumeration via Response Timing

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-007...

TYPO3-CORE-SA-2022-007: User Enumeration via Response Timing

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-007...

TYPO3 安全漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. A security vulnerability exists in TYPO3. An attacker exploited the vulnerability to distinguish between existing and non-existing user accounts by observing the response time...

PT-2022-23195 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 7.6.58 ELTS TYPO3 versions prior to 8.7.48 ELTS TYPO3 versions prior to 9.5.37 ELTS TYPO3 versions prior to 10.4.32 TYPO3 versions prior to 11.5.16 Description: It has been discovered that observing response time durin...

User Enumeration via Response Timing

Description There is a significant timing difference in the login functionality for valid and invalid usernames. Proof of Concept Steps to reproduce: 1. Attempt a Login with a valid user and an invalid user and observe the difference in the response time Here is a small test script alternatively ...

PT-2022-7383 · Dell · Dell Bsafe Crypto-C Micro Edition +1

Name of the Vulnerable Software and Affected Versions: Dell BSAFE Crypto-C Micro Edition versions before 4.1.5 Dell BSAFE Micro Edition Suite versions before 4.6 Description: The issue is related to an Observable Timing Discrepancy, which can be exploited to reveal protected information. This is...

Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients

Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been...

CVE-2022-37146

The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid, unlocked users configured to use PlexTrac as their authentication provider ta...

PT-2022-23838 · Plextrac · Plextrac

Name of the Vulnerable Software and Affected Versions: PlexTrac versions prior to 1.28.0 Description: The issue allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. An unauthenticated remote attacker ca...

PlexTrac 安全漏洞

PlexTrac is a penetration test reporting and management platform from the US-based PlexTrac, Inc. A security vulnerability exists in PlexTrac platform versions prior to 1.28.0 that stems from a username enumeration that allows invalid login attempts via HTTP response time for users configured to...

CVE-2022-3143

A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or...

Red Hat wildfly-elytron 安全漏洞

Red Hat wildfly-elytron is the United States Red Hat Red Hat a security framework. It is used to unify security across application servers. A security vulnerability exists in Red Hat wildfly-elytron, which stems from the possibility of timing attacks through the use of insecure comparators...

Security update for python-M2Crypto (important)

openSUSE Security Update: Security update for python-M2Crypto Announcement ID: openSUSE-SU-2022:2562-1 Rating: important References: 1178829 Cross-References: CVE-2020-25657 CVSS scores: CVE-2020-25657 NVD : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-25657 SUSE: 7.5...

Ubuntu: Security Advisory (USN-4397-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...