CVSS: 5.9EPSS: 0%CPEs: 11EXPL: 1CVE-2023-26154
https://notcve.org/view.php?id=CVE-2023-26154
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file. **Note:** In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption. Versiones del paquete pubnub anteriores a 7.4.0; todas las versiones del paquete com.pubnub:pubnub; versiones del paquete pubnub anteriores a 6.19.0; todas las versiones del paquete github.com/pubnub/go; versiones del paquete github.com/pubnub/go/v7 anteriores a 7.2.0; versiones del paquete pubnub anteriores a 7.3.0; versiones del paquete pubnub/pubnub anteriores a 6.1.0; versiones del paquete pubnub anteriores a 5.3.0; versiones del paquete pubnub anteriores a 0.4.0; versiones del paquete pubnub/c-core anteriores a 4.5.0; versiones del paquete com.pubnub:pubnub-kotlin anteriores a 7.7.0; versiones del paquete pubnub/swift anteriores a 6.2.0; versiones del paquete pubnub anteriores a 5.2.0; Las versiones del paquete pubnub anteriores a la 4.3.0 son vulnerables a una entropía insuficiente a través de la función getKey, debido a una implementación ineficiente del algoritmo criptográfico AES-256-CBC. La función de cifrado proporcionada es menos segura cuando se aplica codificación y recorte hexadecimal, dejando la mitad de los bits de la clave siempre igual para cada mensaje o archivo codificado. • https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0 https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70 https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119 https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384 https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372 https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373 https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374 https://security.snyk.io/vuln/SNYK-JAVA • CWE-331: Insufficient Entropy •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2022-24329
https://notcve.org/view.php?id=CVE-2022-24329
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. En JetBrains Kotlin versiones anteriores a 1.6.0, no era posible bloquear dependencias para proyectos Gradle multiplataforma. • https://blog.jetbrains.com https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021 https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujul2022.html • CWE-667: Improper Locking •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-29582 – kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure
https://notcve.org/view.php?id=CVE-2020-29582
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions. En JetBrains Kotlin versiones anteriores a 1.4.21, una API Java vulnerable era usada para la creación de archivos y carpetas temporales. Un atacante era capaz de leer datos de dichos archivos y enumerar directorios debido a permisos no seguros • https://blog.jetbrains.com https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020 https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujan2022.html https://access.redhat.com/security/cve/CVE-2020-29582 https://bugzilla.redhat.com/show_bug.cgi?id=1930291 • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2020-15824
https://notcve.org/view.php?id=CVE-2020-15824
In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default. En JetBrains Kotlin desde la versión 1.4-M1 a la 1.4-RC (ya que Kotlin versión 1.3.7x no se ve afectado por el problema. La versión corregida es la 1.4.0) se presenta una vulnerabilidad de escalada de privilegios de la caché de scripts debido a scripts kotlin-main-kts almacenados en caché en el directorio temporal del sistema, que es compartido por todos los usuarios por defecto. • http://www.openwall.com/lists/oss-security/2020/12/06/1 https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020 https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3E https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3E https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3E https://lists.apache.org/thread.html/ra • CWE-269: Improper Privilege Management •