Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

bouncycastle legion-of-the-bouncy-castle vulnerabilities and exploits

(subscribe to this query)
9.8
CVSSv3
CVE-2018-1000613
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserializat...
Bouncycastle Legion-of-the-bouncy-castle-java-crytography-apiNetapp Oncommand Workflow Automation -Opensuse Leap 15.1Oracle Retail Xstore Point Of Service 7.1Oracle Api Gateway 11.1.2.4.0Oracle Enterprise Repository 12.1.3.0.0Oracle Retail Xstore Point Of Service 7.0Oracle Enterprise Repository 11.1.1.7.0Oracle Peoplesoft Enterprise Peopletools 8.55Oracle Peoplesoft Enterprise Peopletools 8.56Oracle Communications Webrtc Session Controller 7.2Oracle Webcenter Portal 12.2.1.3.0Oracle Webcenter Portal 11.1.1.9.0Oracle Weblogic Server 12.2.1.3Oracle Business Process Management Suite 12.1.3.0.0Oracle Business Process Management Suite 12.2.1.3.0Oracle Business Process Management Suite 11.1.1.9.0Oracle Soa Suite 12.1.3.0.0Oracle Soa Suite 12.2.1.3.0Oracle Peoplesoft Enterprise Peopletools 8.57Oracle Managed File Transfer 12.2.1.3.0Oracle Communications Converged Application Server
8.1
CVSSv3
CVE-2020-28052
An issue exists in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.66Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.65Apache Karaf 4.3.2Oracle Peoplesoft Enterprise Peopletools 8.56Oracle Webcenter Portal 12.2.1.3.0Oracle Webcenter Portal 11.1.1.9.0Oracle Peoplesoft Enterprise Peopletools 8.57Oracle Utilities Framework 4.3.0.6.0Oracle Utilities Framework 4.4.0.0.0Oracle Peoplesoft Enterprise Peopletools 8.58Oracle Webcenter Portal 12.2.1.4.0Oracle Utilities Framework 4.4.0.2.0Oracle Banking Extensibility Workbench 14.3.0Oracle Banking Virtual Account Management 14.3.0Oracle Banking Credit Facilities Process Management 14.3.0Oracle Banking Corporate Lending Process Management 14.3.0Oracle Communications Messaging Server 8.1Oracle Commerce Guided Search 11.3.2Oracle Communications Messaging Server 8.0.2Oracle Utilities Framework 4.4.0.3.0Oracle Communications Cloud Native Core Network Slice Selection Function 1.2.1Oracle Communications Pricing Design Center 12.0.0.3.0
7.5
CVSSv3
CVE-2019-17359
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.63Apache Tomee 7.0.7Apache Tomee 7.1.2Apache Tomee 8.0.1Netapp Oncommand Workflow Automation -Netapp Service Level Manager -Netapp Oncommand Api Services -Netapp Active Iq Unified ManagerOracle Flexcube Private Banking 12.1.0Oracle Flexcube Private Banking 12.0.0Oracle Peoplesoft Enterprise Peopletools 8.56Oracle Hospitality Guest Access 4.2.0Oracle Weblogic Server 12.2.1.3.0Oracle Webcenter Portal 12.2.1.3.0Oracle Webcenter Portal 11.1.1.9.0Oracle Business Process Management Suite 12.2.1.3.0Oracle Soa Suite 12.2.1.3.0Oracle Peoplesoft Enterprise Peopletools 8.57Oracle Managed File Transfer 12.2.1.3.0Oracle Retail Xstore Point Of Service 18.0.1Oracle Weblogic Server 12.2.1.4.0Oracle Peoplesoft Enterprise Peopletools 8.58
7.5
CVSSv3
CVE-2018-1000180
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and previous versions have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fi...
Bouncycastle Fips Java ApiBouncycastle Legion-of-the-bouncy-castle-java-crytography-apiDebian Debian Linux 9.0Oracle Retail Xstore Point Of Service 7.1Oracle Api Gateway 11.1.2.4.0Oracle Weblogic Server 12.1.3.0.0Oracle Enterprise Repository 12.1.3.0.0Oracle Retail Xstore Point Of Service 7.0Oracle Peoplesoft Enterprise Peopletools 8.55Oracle Peoplesoft Enterprise Peopletools 8.56Oracle Webcenter Portal 12.2.1.3.0Oracle Webcenter Portal 11.1.1.9.0Oracle Business Process Management Suite 12.1.3.0.0Oracle Business Process Management Suite 12.2.1.3.0Oracle Business Process Management Suite 11.1.1.9.0Oracle Soa Suite 12.1.3.0.0Oracle Soa Suite 12.2.1.3.0Oracle Peoplesoft Enterprise Peopletools 8.57Oracle Managed File Transfer 12.2.1.3.0Oracle Communications Converged Application ServerOracle Communications Webrtc Session ControllerOracle Retail Convenience And Fuel Pos Software 2.8.1
7.5
CVSSv3
CVE-2016-1000338
In Bouncy Castle JCE Provider version 1.55 and previous versions the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow ...
Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api
7.4
CVSSv3
CVE-2016-1000344
In the Bouncy Castle JCE Provider version 1.55 and previous versions the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api
7.4
CVSSv3
CVE-2016-1000352
In the Bouncy Castle JCE Provider version 1.55 and previous versions the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api
5.9
CVSSv3
CVE-2020-15522
Bouncy Castle BC Java prior to 1.66, BC C# .NET prior to 1.8.7, BC-FJA prior to 1.0.1.2, 1.0.2.1, and BC-FNA prior to 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information fo...
Bouncycastle Bc-csharpBouncycastle Bouncy Castle Fips .net ApiBouncycastle Legion-of-the-bouncy-castle-fips-java-apiBouncycastle The Bouncy Castle Crypto Package For Java
5.9
CVSSv3
CVE-2016-1000345
In the Bouncy Castle JCE Provider version 1.55 and previous versions the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryptio...
Bouncycastle Legion-of-the-bouncy-castle-java-crytography-apiDebian Debian Linux 8.0
5.9
CVSSv3
CVE-2017-13098
BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a ...
Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-26925CVE-2023-41826LFICVE-2022-22364CVE-2024-2887command injectionremote code executionCVE-2024-34446CVE-2022-48699
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook