[SECURITY] Fedora 26 Update: drawtiming-0.7.1-22.fc26

A command line tool for generating timing diagrams from ASCII input files. The input files use a structured language to represent signal state transitions and interdependencies. Raster image output support is provided by ImageMagick. It can be used for VHDL or verilog presentations...

VaultPress 1.89-1.9 - Unauthenticated RCE

The builtin WAF must be disabled or bypassed for successful exploitation. v1.89 - Improper usage of opensslverify - signature compare - timing attack unsafe v1.9 - signature compare - timing attack unsafe...

Timing Attack

craftcms/cms is vulnerable to timing attack. The application uses the strcmp function that compares hashes in non-constant time, allowing an attacker to use the timing of the request to progressively identify the current PHP session id...

Timing Attack

drupal/core is vulnerable to timing attacks. The library is vulnerable because it does not compare CSRF tokens with a constant time string comparison which allows malicious users to use the timing of the request to progressively identify a valid CSRF token...

EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2017-1191)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to...

EulerOS 2.0 SP1 : openssh (EulerOS-SA-2017-1189)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could...

EulerOS 2.0 SP2 : authconfig (EulerOS-SA-2017-1196)

According to the version of the authconfig packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found where authconfig could configure sssd in a way that treats existing and non-existing logins differently, leaking information o...

EulerOS 2.0 SP2 : openssh (EulerOS-SA-2017-1190)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could...

EulerOS 2.0 SP1 : authconfig (EulerOS-SA-2017-1195)

According to the version of the authconfig packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found where authconfig could configure sssd in a way that treats existing and non-existing logins differently, leaking information o...

Das U-Boot AES-CBC encryption implementation contains multiple vulnerabilities

Overview Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector and improper handling of an error condition may allow attacks against the underlying...

CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

DEBIAN-CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

Design/Logic Flaw

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

UBUNTU-CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

CVE-2015-3250

CVE-2015-3250 affects the Apache Directory LDAP API prior to 1.0.0-M31. The vulnerability allows timing attacks via unspecified vectors. This is consistently described across multiple sources (GHSA, NVD, OSV, Ubuntu/Debian OSV), though exploitation details and remediation are not provided in the ...

CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

CVE-2015-3250

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors...

Timing Attack

automattic/jetpack is vulnerable to timing attacks. This vulnerability is caused because the secrets are not compared in constant time, allowing malicious users to guess the valid secrets based on the time that a comparison takes...