The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Affected: npm: elliptic

The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

SSL/TLS: CBC padding timing attack (lucky-13) grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions kibana: Prototype pollution in TSVB could result in arbitrary code execution (ESA-2020-06) nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser nodejs-lodash: prototype pollution in zipObjectDeep function kubernetes: compromised node could escalate to cluster level privileges golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic openshift/console: text injection on error page via crafted url kibana: X-Frame-Option not set by default might lead to clickjacking jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods grafana: stored XSS grafana: XSS annotation popup vulnerability grafana: XSS via column.title or cellLinkTooltip nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash open…

Affected: Ubuntu:18.04:LTS: node-elliptic, Ubuntu:20.04:LTS: node-elliptic

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise in diversen Komponenten von Drittanbietern ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.