Vulnerabilities (CVE)

Filtered by CWE-361
Total 7 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2016-1000345 2 Bouncycastle, Debian 2 Legion-of-the-bouncy-castle-java-crytography-api, Debian Linux 2024-02-28 4.3 MEDIUM 5.9 MEDIUM
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.
CVE-2016-1000341 2 Bouncycastle, Debian 2 Legion-of-the-bouncy-castle-java-crytography-api, Debian Linux 2024-02-28 4.3 MEDIUM 5.9 MEDIUM
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
CVE-2015-5300 7 Canonical, Debian, Fedoraproject and 4 more 20 Ubuntu Linux, Debian Linux, Fedora and 17 more 2024-02-28 5.0 MEDIUM 7.5 HIGH
The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).
CVE-2016-7036 1 Python-jose Project 1 Python-jose 2024-02-28 7.5 HIGH 9.8 CRITICAL
python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.
CVE-2016-7547 1 Trendmicro 1 Threat Discovery Appliance 2024-02-28 7.5 HIGH 9.8 CRITICAL
A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.cgi interface.
CVE-2016-7037 1 Jwt Project 1 Jwt 2024-02-28 5.0 MEDIUM 7.5 HIGH
The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack.
CVE-2016-1643 1 Google 1 Chrome 2024-02-28 9.3 HIGH 8.8 HIGH
The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly maintain the user agent shadow DOM, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."