#cwe-208

共收录 121 条相关情报。

漏洞预警2026-10-30 发布MEDIUM

secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through `Point#mul` or `scalar_multiply_c...

CVE-2026-63410

secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar

来源摘录 · NVD

#cve #cwe-1255 #cwe-208

漏洞预警2026-10-30 发布MEDIUM

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discr...

CVE-2026-62860

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint

来源摘录 · NVD

#cve #cwe-208

漏洞预警2026-10-27 发布INFO

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to ...

CVE-2026-93434

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-208 #cwe-643

漏洞预警2026-10-26 发布INFO

Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fal...

CVE-2026-65630

Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key throug

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

安全公告2026-10-22 发布INFO

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute...

CVE-2026-87946

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affect

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-208

漏洞预警2026-10-22 发布INFO

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3....

CVE-2026-87946

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affect

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

安全公告2026-10-22 发布INFO

SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144

CVE-2026-87946

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affect

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-208

漏洞预警2026-10-13 发布INFO

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authoriza...

CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKC

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

安全公告2026-10-13 发布INFO

OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison

CVE-2026-49265

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKC

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-208

漏洞预警2026-10-12 发布INFO

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/c...

CVE-2026-109379

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enum

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-10-12 发布INFO

A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authenticati...

CVE-2026-83535

A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigur

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

安全公告2026-10-03 发布INFO

In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels:...

CVE-2026-18040

In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-208 #severity:medium

漏洞预警2026-10-03 发布INFO

In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the ...

CVE-2026-18040

In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

安全公告2026-10-03 发布INFO

HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler

CVE-2026-18040

In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-208

漏洞预警2026-10-02 发布INFO

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each re...

CVE-2026-18036

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference i

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

安全公告2026-10-02 发布INFO

NTRU leaks private key information by reducing secret values with a non-constant-time integer division

CVE-2026-18036

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference i

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-208

漏洞预警2026-09-29 发布INFO

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signi...

CVE-2026-77696

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channe

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-09-29 发布INFO

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary:...

CVE-2026-54875

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key o

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-09-29 发布INFO

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks informa...

CVE-2026-54872

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

安全公告2026-09-29 发布INFO

Timing Side-Channel in SM2 Signature Generation

CVE-2026-77696

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channe

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-208