CVE-2021-43398

Crypto++ aka Cryptopp 8.6.0 and earlier contains a timing leakage in MakePublicKey. There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks. NOTE: this...

Information disclosure

DISPUTED Crypto++ aka Cryptopp 8.6.0 and earlier contains a timing leakage in MakePublicKey. There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks...

CVE-2021-43398

Crypto++ aka Cryptopp 8.6.0 and earlier contains a timing leakage in MakePublicKey. There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks. NOTE: this...

CVE-2021-43398

Crypto++ (Cryptopp) versions 8.6.0 and earlier have a timing leakage in MakePublicKey(), with execution time correlated to private key length. This could enable timing-based information disclosure, though the vendor and third parties dispute the severity and attribute differences to an intentiona...

CVE-2021-43398

Crypto++ aka Cryptopp 8.6.0 and earlier contains a timing leakage in MakePublicKey. There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks. NOTE: this...

CVE-2021-43398

Removed by vendor...

Zivver: Timing difference exposes existence of accounts

This report concerns a timing-based enumeration of user accounts through the authentication endpoint. While the Zivver product offers intended ways to identify if another person is a Zivver user by their email address, this report was novel in that it allows this behavior pre-authentication...

CVE-2021-35535

Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network port and to cause a reboot sequences of the device may exploit the vulnerability, where there is a tiny time gap during the booting process...

PT-2021-23829 · Crypto++ · Crypto++

Name of the Vulnerable Software and Affected Versions: Crypto++ aka Cryptopp versions 8.6.0 and earlier Description: The issue concerns a timing leakage in the MakePublicKey function, where there is a correlation between execution time and private key length. This could potentially allow attacker...

Crypto++ 安全漏洞

Crypto++ is a C++ cryptographic method library. A security vulnerability exists in Crypto++ a.k.a. Cryptopp versions 8.6.0 and earlier, which stems from the software containing a timing leak in MakePublicKey. There is a significant correlation between the private key execution time and the privat...

The vulnerability of the SysController and MailHandlerController components of the Redmine project and task management web application, related to the disclosure of information due to incompatibility, allows a hacker to gain access to confidential data.

The vulnerability of the SysController and MailHandlerController components in the Redmine project and task management web application is related to changes in the time required for string comparison operations. Exploiting this vulnerability could allow a malicious actor to gain access to...

Qualcomm 多款组件加密问题漏洞

Qualcomm MDM9206 and others are products of Qualcomm Incorporated.MDM9206 is a central processing unit CPU.MDM9607 is a central processing unit CPU.MDM9640 is a central processing unit CPU.MDM9650 is a central processing unit CPU.MSM8996AU is a central processing unit CPU.QCA6574AU is a central...

Uber: Exposed Golang Pprof debugger at https://cn-geo1.uber.com/

The Golang pprof debug interface was exposed on an Uber endpoint. This allowed introspection of stack traces, application timing, command line parameters and memory usage...

Information disclosure

PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart, this uses timing information based on the processor's high resolution timer the RDTSC instruction. This instruction can be virtualized, and some virtual machine hosts have chosen to disable this...

NewStart CGSL CORE 5.05 / MAIN 5.05 : ovmf Multiple Vulnerabilities (NS-SA-2021-0180)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ovmf packages installed that are affected by multiple vulnerabilities: - Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service vi...

NewStart CGSL CORE 5.04 / MAIN 5.04 : microcode_ctl Multiple Vulnerabilities (NS-SA-2021-0113)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has microcodectl packages installed that are affected by multiple vulnerabilities: - Incomplete cleanup in some IntelR VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access...

wildfly-elytron: possible timing attack in ScramServer

A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality...

DEBIAN-CVE-2021-38562

Best Practical Request Tracker RT 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm...

CVE-2021-38562

Best Practical Request Tracker RT 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm...

Information disclosure

Best Practical Request Tracker RT 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm...