#cwe-208

共收录 121 条相关情报。

漏洞预警2026-08-11 发布INFO

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit...

CVE-2026-6727

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with a

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-08-06 发布INFO

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content v...

CVE-2025-49506

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or p

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-08-06 发布INFO

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated att...

CVE-2026-16731

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-08-06 发布INFO

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated att...

CVE-2026-16315

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-08-05 发布INFO

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected...

CVE-2026-70437

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-08-03 发布INFO

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7...

CVE-2026-69247

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 unti

历史摘要 · 未重新核验 · NVD

#cve #cwe-208 #cwe-209

安全公告2026-08-03 发布INFO

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

CVE-2026-69247

### Summary `pkcs7_decrypt_der`, `pkcs7_decrypt_pem`, and `pkcs7_decrypt_smime` reported the outcome of decrypting a `R

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-208 #cwe-209 #severity:high

漏洞预警2026-08-03 发布INFO

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username e...

CVE-2026-8794

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-07-28 发布INFO

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which dec...

CVE-2024-14041

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polyno

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

安全公告2026-07-28 发布INFO

ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)

CVE-2024-14041

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polyno

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-208

漏洞预警2026-07-22 发布INFO

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling...

CVE-2026-13183

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-07-21 发布INFO

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig ...

CVE-2026-15432

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time compar

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

漏洞预警2026-07-20 发布INFO

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time....

CVE-2026-54685

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` a

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

安全公告2026-07-20 发布INFO

FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

CVE-2026-54685

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` a

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-208

漏洞预警2026-07-20 发布INFO

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. This allows discrepancies in timing t...

CVE-2026-6656

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the bu

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

安全公告2026-07-17 发布INFO

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string...

CVE-2026-9537

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode()

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-208

漏洞预警2026-07-17 发布INFO

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the supplied signature to the recomputed...

CVE-2026-9537

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode()

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

安全公告2026-07-17 发布INFO

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison

CVE-2026-9537

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode()

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-208

漏洞预警2026-07-15 发布INFO

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function...

CVE-2026-56764

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-consta

历史摘要 · 未重新核验 · NVD

#cve #cwe-208

安全公告2026-07-15 发布INFO

Hono - Timing Attack in basicAuth and bearerAuth Middleware

CVE-2026-56764

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-consta

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-208