Lucene search
+L

474634 matches found

Snyk
Snyk
added 2026/08/03 3:53 a.m.7 views

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the getContentStream method of RecipientInformation, which, when authenticated attributes are present, authenticates only the DER-encoded authAttrs and never checks the computed content...

8.7CVSS5.6AI score0.00157EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.6 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the PKMACValueVerifier.isValid and ProtectedPKIMessage.verify verification paths, where PKMACBuilder's default constructor leaves maxIterations = 0 and disables the iteration-count...

6.9CVSS5.5AI score0.00263EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.7 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the PKMACValueVerifier.isValid and ProtectedPKIMessage.verify verification paths, where PKMACBuilder's default constructor leaves maxIterations = 0 and disables the iteration-count...

6.9CVSS5.5AI score0.00263EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.5 views

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...

8.7CVSS5.5AI score0.00263EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.6 views

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...

8.7CVSS5.5AI score0.00263EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.4 views

Excessive Iteration

Overview Affected versions of this package are vulnerable to Excessive Iteration in the HashRatchet.getint generation method of GroupKeySet, reached through PrivateMessage.unprotect, which loops while nextGeneration generation next; and caches every intermediate KeyGeneration in an unbounded...

8.7CVSS5.5AI score0.00263EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.9 views

Uncontrolled Recursion

Overview org.bouncycastle:bcprov-ext-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Uncontrolled Recursion in the OERInputStream.parseElement method, which processes the SEQ, CHOICE, and Supplier children of an IEEE 1609.2 structure...

8.7CVSS5.5AI score0.00263EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.7 views

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the processRecord method of DTLSReliableHandshake, where the DTLSReassembler constructor allocates a bytelength buffer directly from the 24-bit handshake length field without checking it...

8.7CVSS5.6AI score0.00291EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.9 views

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

8.7CVSS5.5AI score0.00174EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.7 views

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

8.7CVSS5.5AI score0.00174EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.7 views

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

8.7CVSS5.5AI score0.00174EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.6 views

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

8.7CVSS5.5AI score0.00174EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.7 views

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

8.7CVSS5.5AI score0.00174EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.6 views

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

8.7CVSS5.5AI score0.00174EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.6 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the S2K.Argon2Params class and the PGPUtil.makeKeyFromPassPhrase method, which read the one-byte OpenPGP Argon2 passes, parallelism, and memory-size exponent fields with only a...

6.9CVSS5.5AI score0.00263EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.6 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the S2K.Argon2Params class and the PGPUtil.makeKeyFromPassPhrase method, which read the one-byte OpenPGP Argon2 passes, parallelism, and memory-size exponent fields with only a...

6.9CVSS5.5AI score0.00263EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.7 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the S2K.Argon2Params class and the PGPUtil.makeKeyFromPassPhrase method, which read the one-byte OpenPGP Argon2 passes, parallelism, and memory-size exponent fields with only a...

6.9CVSS5.5AI score0.00263EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.8 views

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the readPacket method of UserAttributeSubpacketInputStream, which reads a 5-octet subpacket length up to Integer.MAXVALUE and allocates new bytebodyLen-1 after checking only against a limit...

8.7CVSS5.5AI score0.00263EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.9 views

Inadequate Encryption Strength

Overview Affected versions of this package are vulnerable to Inadequate Encryption Strength in the BcKeyStoreSpi.engineLoad method, which for legacy BKS keystore versions 0 and 1 passes hMac.getMacSize 20 bytes for SHA-1 to generateDerivedMacParameters, where PKCS12ParametersGenerator divides it ...

7.1CVSS5.5AI score0.00174EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 3:53 a.m.7 views

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the OnePassSignatures.verify method of OpenPGPMessageInputStream, whose catch PGPSignatureException block for the dataSignature.sanitizekey, policy check contains only a // continue...

8.7CVSS5.8AI score0.00174EPSS
SaveExploits0References2
Rows per page
Query Builder