SUSE CVE-2024-53846

OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and...

SUSE CVE-2024-48948

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an truncateToN anomaly. This leads to...

SUSE CVE-2024-40648

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The UserIdentity::isverified method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result retur...

odn.nl Cross Site Scripting vulnerability OBB-3942113

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the gnutls_x509_trust_list_verify_crt2() function in the GnuTLS security library allows a attacker to cause a service failure.

The vulnerability of the gnutlsx509trustlistverifycrt2 function in the GnuTLS security library is related to deficiencies in handling exceptional states during the analysis of the certlistsize parameter. Exploiting this vulnerability could allow an attacker to cause a service failure by sending a...

Splunk 安全漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. Splunk...

php: Password_verify() always return true with some hash

A vulnerability was found in PHP. This security flaw occurs when malformatted BCrypt hashes that include a $ within their salt part trigger a buffer overread and may erroneously validate any password as valid...

password_verify() always returns true for some invalid hashes

...

online.sia.politanisamarinda.ac.id Cross Site Scripting vulnerability OBB-3147833

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

hosted.tuktukpatrol.com Cross Site Scripting vulnerability OBB-2847880

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

peek-a-boo-magazine.be Cross Site Scripting vulnerability OBB-2288405

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PYSEC-2021-426

The verify function in the Stark Bank Python ECDSA library ecdsa-python 2.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...

The vulnerability of the libdnf package manager library involves incorrect verification of the cryptographic signature of data. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the package manager library libdnf is related to a bug in the signature verification function. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

CVE-2021-0341

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

GitHub Security Lab: [Java] CWE-295 - Incorrect Hostname Verification - MitM

This bug was reported directly to GitHub Security Lab...

hq.hatcher.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1155341 Security Researcher Implosion Helped patch 1643 vulnerabilities Received 7 Coordinated Disclosure badges Received 29 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting hq.hatcher.com website a...

The vulnerability in the built-in software of NETGEAR routers such as NETGEAR R8500, NETGEAR R8300, NETGEAR R7000, NETGEAR R6400, NETGEAR R7300DST, NETGEAR R7100LG, NETGEAR R6300v2, NETGEAR WNDR3400v3, NETGEAR WNDR3500Lv2, NETGEAR R6250, NETGEAR R6700, NETGEAR R6900, NETGEAR R8000, NETGEAR R7900, NETGEAR WNDR4500v2, NETGEAR R6200v2, NETGEAR WNDR3400v2, NETGEAR D6220, NETGEAR D6400, NETGEAR C6300, NETGEAR R6200, NETGEAR R6300, NETGEAR VENG2610, NETGEAR AC1450, NETGEAR WNDR1000v3, NETGEAR WNDR3700v3, NETGEAR WNDR4000, NETGEAR WNDR4500, NETGEAR D6300, NETGEAR D6300B, NETGEAR DGN2200Bv4, and NETGEAR DGN2200v4, allows a hacker to obtain user password information.

The vulnerability of the embedded software of NETGEAR routers such as NETGEAR R8500, NETGEAR R8300, NETGEAR R7000, NETGEAR R6400, NETGEAR R7300DST, NETGEAR R7100LG, NETGEAR R6300v2, NETGEAR WNDR3400v3, NETGEAR WNDR3500Lv2, NETGEAR R6250, NETGEAR R6700, NETGEAR R6900, NETGEAR R8000, NETGEAR R7900,...

MGASA-2016-0094 Updated samba packages fix security vulnerabilities

Updated ldb and samba packages fix security vulnerabilities: A malicious client can send packets that cause the LDAP server in the samba daemon process to become unresponsive, preventing the server from servicing any other requests CVE-2015-3223. Versions of Samba from 3.0.0 to 4.3.2 inclusive ar...

Facebook Glitch Locks Out Accounts

A bug in an account verification system used by Facebook resulted in a wave of account suspensions Tuesday that had users locked out of the world’s largest social network and scratching their heads over the reason. Facebook discovered a bug in a system designed to detect and disable fake accounts...

gnupg security update

CentOS Errata and Security Advisory CESA-2006:0266-01 An updated GnuPG package that fixes signature verification flaws as well as minor bugs is now available. This update has been rated as having important security impact by the Red Hat Security Response Team. GnuPG is a utility for encrypting da...