CWE-320 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-320/ Sun, 26 Feb 2023 06:51:46 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-320 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-320/ 32 32 CVE-2018-9234 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-9234/ Sun, 26 Feb 2023 06:51:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-9234/ GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.

The post CVE-2018-9234 appeared first on CVE Vulnerability.

]]> GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.

The post CVE-2018-9234 appeared first on CVE Vulnerability.

]]> CVE-2018-7559 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7559/ Sun, 26 Feb 2023 06:51:05 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7559/ An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server’s private key by sending carefully constructed bad UserIdentityTokens as part […]

The post CVE-2018-7559 appeared first on CVE Vulnerability.

]]> An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server’s private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.

The post CVE-2018-7559 appeared first on CVE Vulnerability.

]]> CVE-2018-7534 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7534/ Sun, 26 Feb 2023 06:51:04 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7534/ In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory.

The post CVE-2018-7534 appeared first on CVE Vulnerability.

]]> In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory.

The post CVE-2018-7534 appeared first on CVE Vulnerability.

]]> CVE-2018-20187 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-20187/ Sun, 26 Feb 2023 06:48:29 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-20187/ A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation may be able to derive information about the high bits of the secret key, as the function to derive the public point from the secret scalar uses an unblinded Montgomery ladder whose loop […]

The post CVE-2018-20187 appeared first on CVE Vulnerability.

]]> A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation may be able to derive information about the high bits of the secret key, as the function to derive the public point from the secret scalar uses an unblinded Montgomery ladder whose loop iteration count depends on the bitlength of the secret. This issue affects only key generation, not ECDSA signatures or ECDH key agreement.

The post CVE-2018-20187 appeared first on CVE Vulnerability.

]]> CVE-2018-12433 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-12433/ Sun, 26 Feb 2023 06:45:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-12433/ ** DISPUTED ** cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. NOTE: the vendor does not include […]

The post CVE-2018-12433 appeared first on CVE Vulnerability.

]]> ** DISPUTED ** cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. NOTE: the vendor does not include side-channel attacks within its threat model.

The post CVE-2018-12433 appeared first on CVE Vulnerability.

]]> CVE-2018-12438 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-12438/ Sun, 26 Feb 2023 06:45:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-12438/ The Elliptic Curve Cryptography library (aka sunec or libsunec) allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

The post CVE-2018-12438 appeared first on CVE Vulnerability.

]]> The Elliptic Curve Cryptography library (aka sunec or libsunec) allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

The post CVE-2018-12438 appeared first on CVE Vulnerability.

]]> CVE-2018-0732 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-0732/ Sun, 26 Feb 2023 06:44:20 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-0732/ During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could […]

The post CVE-2018-0732 appeared first on CVE Vulnerability.

]]> During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

The post CVE-2018-0732 appeared first on CVE Vulnerability.

]]> CVE-2018-0124 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-0124/ Sun, 26 Feb 2023 06:44:04 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-0124/ A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The vulnerability is due to insecure key generation during application configuration. An attacker could exploit this vulnerability by using a known insecure key value to bypass security protections by sending […]

The post CVE-2018-0124 appeared first on CVE Vulnerability.

]]> A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The vulnerability is due to insecure key generation during application configuration. An attacker could exploit this vulnerability by using a known insecure key value to bypass security protections by sending arbitrary requests using the insecure key to a targeted application. An exploit could allow the attacker to execute arbitrary code. This vulnerability affects Cisco Unified Communications Domain Manager releases prior to 11.5(2). Cisco Bug IDs: CSCuv67964.

The post CVE-2018-0124 appeared first on CVE Vulnerability.

]]> CVE-2019-9894 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-9894/ Sun, 26 Feb 2023 06:35:07 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-9894/ A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.

The post CVE-2019-9894 appeared first on CVE Vulnerability.

]]> A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.

The post CVE-2019-9894 appeared first on CVE Vulnerability.

]]> CVE-2019-9150 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-9150/ Sun, 26 Feb 2023 06:34:51 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-9150/ Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or obscure which key was imported.

The post CVE-2019-9150 appeared first on CVE Vulnerability.

]]> Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or obscure which key was imported.

The post CVE-2019-9150 appeared first on CVE Vulnerability.

]]>