CVE-2025-54999

CVE-2025-54999 affects OpenBao (versions 0.1.0–2.3.1) via the userpass authentication method, enabling user enumeration due to timing differences between non-existent users and those with credentials. This timing side-channel is independent of credential validity. The issue is fixed in version 2....

riscv-boom SonicBOOM 安全漏洞

riscv-boom SonicBOOM is a SonicBOOM: The Berkeley Out-of-Order RISC-V Processor open source SonicBOOM: The Berkeley Chaos Machine. A security vulnerability exists in riscv-boom SonicBOOM 2.2.3 and earlier versions, which stems from an observable timing difference issue in the component L1 Data...

Linux Distros Unpatched Vulnerability : CVE-2022-50016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a...

Linux Distros Unpatched Vulnerability : CVE-2022-31742

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles a...

Linux Distros Unpatched Vulnerability : CVE-2023-4421

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The NSS code used for checking PKCS1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as...

Linux Distros Unpatched Vulnerability : CVE-2019-9815

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to...

Linux Distros Unpatched Vulnerability : CVE-2022-45403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range...

Linux Distros Unpatched Vulnerability : CVE-2024-26898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - aoe: fix the potential use-after-free problem in aoecmdcfgpkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over...

OpenBao has a Timing Side-Channel in the Userpass Auth Method

Impact When using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users and users with stored credentials. This is independent of whether the supplied credentials were valid for the given user. Patches OpenBao v2.3.2 will patch this issu...

GHSA-HH28-H22F-8357 OpenBao has a Timing Side-Channel in the Userpass Auth Method

Impact When using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users and users with stored credentials. This is independent of whether the supplied credentials were valid for the given user. Patches OpenBao v2.3.2 will patch this issu...

GHSA-6JCC-XGCR-Q3H4 @fedify/fedify has Improper Authentication and Incorrect Authorization

Summary An authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor...

Linux Distros Unpatched Vulnerability : CVE-2022-50177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: rcutorture: Fix ksoftirqd boosting timing and iteration The RCU priority boosting can fail i...

Linux Distros Unpatched Vulnerability : CVE-2022-50015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will sen...

SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2025:02719-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02719-1 advisory. - CVE-2024-2236: timing-based side-channel flaw in RSA implementation can lead to decryption of RSA ciphertexts...

Security Bulletin: IBM i is affected by a timing attack, handling signals in an unsafe manner, and uncontrolled memory consumption due to vulnerabilities in OpenSSH [CVE-2024-39894, CVE-2024-6387, CVE-2025-26466].

Summary OpenSSH used by IBM i is affected by a timing attack against password entry, handling signals in an unsafe manner, and an uncontrolled increase in memory consumption as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerabilitie...

Security update for libgcrypt

This update for libgcrypt fixes the following issues: CVE-2024-2236: timing-based side-channel flaw in RSA implementation can lead to decryption of RSA ciphertexts bsc1221107. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

SUSE-SU-2025:02719-1 Security update for libgcrypt

This update for libgcrypt fixes the following issues: - CVE-2024-2236: timing-based side-channel flaw in RSA implementation can lead to decryption of RSA ciphertexts bsc1221107...

CVE-2025-6011

A flaw was found in github.com/hashicorp/vault. The Userpass authentication method exhibits a timing vulnerability, allowing an attacker to determine whether a username exists within Vault by measuring response times, and enables potential enumeration of valid usernames. This vulnerability allows...

Race Condition

Overview shopware/shopware is an open source e-commerce software made in Germany Affected versions of this package are vulnerable to Race Condition due to the checkout process. An attacker can bypass intended restrictions and redeem vouchers beyond their allowed usage by exploiting timing...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2025-1720)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...