Kenneth G. Paterson

The issue allows a malicious server administrator to recover and modify the contents of end-to-end encrypted files. This is a significant concern for users who rely on the Nextcloud Desktop Client for synchronizing files from Nextcloud Server.

A malicious server administrator can gain full access to an end-to-end encrypted folder, allowing them to decrypt files, recover the folder structure, and add new files.

A malicious server administrator can gain full access to an end-to-end encrypted folder, allowing them to decrypt files, recover the folder structure, and add new files.

Existe uma falha de reordenação no Telegram, permitindo que um invasor faça com que o servidor receba mensagens em uma ordem diferente daquela em que foram enviadas ao cliente. Essa falha pode ser explorada por um invasor, levando potencialmente a consequências indesejadas.

A cache-based side channel in the GnuTLS implementation allows for plain text recovery in a cross-VM attack setting. An attacker can use a combination of "Just in Time" Prime+probe attack and Lucky-13 attack with crafted packets to recover plain text.

Name of the Vulnerable Software and Affected Versions: GnuTLS (affected versions not specified) Description: The issue is related to the GnuTLS implementation of HMAC-SHA-384, which is vulnerable to a Lucky thirteen style attack. This allows remote attackers to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets. The vulnerability is due to errors in the implementation of the cryptographic algorithm, enabling an attacker to exploit it and perform attacks such as plain text recovery. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: GnuTLS (affected versions not specified) Description: The issue is related to the GnuTLS implementation of HMAC-SHA-256, which is vulnerable to a Lucky thirteen style attack. Remote attackers could exploit this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets. The vulnerability is associated with errors in the implementation of the cryptographic algorithm, allowing an attacker to exploit it and perform attacks such as plaintext-recovery attacks using specially crafted packets. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.