389-ds-base: Password verification vulnerable to timing attack

It was found that 389 Directory Server was vulnerable to a remote password disclosure via timing attack. A remote attacker could possibly use this flaw to retrieve directory server password after many tries...

389-ds-base security, bug fix, and enhancement update

1.2.11.15-84 - Release 1.2.11.15-84 - Resolves: 1376676 - Backport AES storage scheme plugin DS 47462 1.2.11.15-83 - Release 1.2.11.15-83 - Resolves: 1376676 - Backport AES storage scheme plugin DS 47462 1.2.11.15-82 - Release 1.2.11.15-82 - Resolves: 1376676 - Backport AES storage scheme plugin ...

Oracle Linux 7 : 389-ds-base (ELSA-2016-2594)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2594 advisory. - Resolves: bug 1360976 - EMBARGOED CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack - Resolves: bug 1350799 - CVE-2016-499...

MGASA-2016-0367 Updated tomcat packages fix security vulnerability

The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder...

Apache Tomcat 8.5.x < 8.5.5 / 9.0.0.x < 9.0.0.M10 Multiple Vulnerabilities

Binary data 9721.pasl...

Moderate: Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

389-ds-base: Password verification vulnerable to timing attack

It was found that 389 Directory Server was vulnerable to a remote password disclosure via timing attack. A remote attacker could possibly use this flaw to retrieve directory server password after many tries...

nettle: RSA/DSA code is vulnerable to cache-timing related attacks

It was found that nettle's RSA and DSA decryption code was vulnerable to cache-related side channel attacks. An attacker could use this flaw to recover the private key from a co-located virtual-machine instance...

The vulnerability of the Linux operating system allows a hacker to obtain information about access restrictions for file system objects.

The vulnerability of the Linux operating system’s kernel is related to errors in the code. Exploiting this vulnerability can allow an attacker, operating locally, to obtain information about the access restrictions for file system objects. This is because requests to resources prohibited to users...

beijing.huimaiche.com XSS vulnerability

Open Bug Bounty ID: OBB-190517 Description| Value ---|--- Affected Website:| beijing.huimaiche.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2016-8871

In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack...

CVE-2016-8871

In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack...

CVE-2016-8871

In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack...

Code injection

In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack...

CVE-2016-8871

CVE-2016-8871 affects Botan 1.11.29 through 1.11.32, where RSA decryption with certain padding options exposes a detectable OAEP timing channel. With a sufficient number of queries, an attacker could recover plaintext. The provided connected documents confirm the vulnerability details but do not ...

CVE-2016-8871

In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack...

CVE-2016-8871

Removed by vendor...

UBUNTU-CVE-2016-0762

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note...

CVE-2016-0762

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note...

USN-3112-1 thunderbird vulnerabilities

Catalin Dumitru discovered that URLs of resources loaded after a navigation start could be leaked to the following page via the Resource Timing API. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to obtain sensiti...