CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-0473
https://notcve.org/view.php?id=CVE-2016-0473
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect integrity via unknown vectors related to Fluid Core. Vulnerabilidad no especificada en el componente PeopleSoft Enterprise PeopleTools en Oracle PeopleSoft Products 8.54 y 8.55 permite a usuarios remotos autenticados afectar a la integridad a través de vectores desconocidos relacionados con Fluid Core. • http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.securitytracker.com/id/1034720 •
CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2015-7940 – bouncycastle: Invalid curve attack allowing to extract private keys
https://notcve.org/view.php?id=CVE-2015-7940
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack." La librería Bouncy Castle Java en versiones anteriores a 1.51 no valida un punto que se encuentra dentro de la curva elíptica, lo que facilita a atacantes remotos obtener claves privadas a través de una serie de intercambios de clave de curva elíptica Diffie Hellman (ECDH) manipulados, también conocida como un 'ataque de curva no válida'. It was found that bouncycastle is vulnerable to an invalid curve attack. An attacker could extract private keys used in elliptic curve cryptography with a few thousand queries. • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174915.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00012.html http://rhn.redhat.com/errata/RHSA-2016-2035.html http://rhn.redhat.com/errata/RHSA-2016-2036.html http://web-in-security.blogspot.ca/2015/09/practical-invalid-curve-attacks.html http://www.debian.org/security/2015/dsa-3417 http://www.openwall.com/lists/oss-security/2015/10/22/7 http://www.openwall.com/lists/oss-security • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-310: Cryptographic Issues CWE-358: Improperly Implemented Security Check for Standard •