⛰️ Features Update to draft-ietf-openpgp-pqc-10 (#565) - (01a9643) 🚜 Refactor Cleanup the interface of crypto::*::SecretKey - (45e1ea8)

Component Severity Major Summary Xverse extension crash when request stx_signMessage Reproduce steps Get stx address and public key import { request } from 'sats-connect'; const res = await...

Developer Leaks Secret Key on GitHub, Loses $40K in 2 Minutes Web3 developer Brian Guan lost $40,000 after accidentally exposing his wallet keys on GitHub. A Web3 developer revealed the unfortunate experience of losing funds as a result of inadvertently…

Dart SDK for the Bayarcash payment gateway. A feature-parity, idiomatic port of the official PHP SDK, usable from Flutter apps and server-side Dart. Changelog excerpt: ### Added - Initial release of the Bayarcash Dart SDK — a feature-parity, idiomatic port of the official PHP SDK. Pure Dart, usable from Flutter apps and server-side Dart. - `Bayarcash`client with named-parameter configuration (`token`, `secretKey`, `sandbox`, `apiVersion`, `timeout`) and an injectable `http.Client`for testing. Fluent `useSandbox()`, `setApiVersion()`, `setTimeout()`, `setToken()`setters are also provided. - API **v2**(default) and **v3**support, with automatic base-URI selecti[...]

Pi Network: Secret Key - Horizon API Operace - PI BAZAR - PI NETWORK - Pi Akademie

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper validation in the PUT /rustfs/admin/v3/import-iam endpoint allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). The endpoint accepts attacker-controlled parent, claims, accessKey, and secretKey values without enforcing …

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API. To exploit this vulnerability, an attacker …

A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod's logs.

这真的不是在整活吗？ 各位可以试试把滚动条拉到底，你就能看到下图迷幻的一幕。 谁会把 secretKey 写在源码里啊？而且 HTML 语法错了，连 chromium 都没兜不住，导致 script 脚本解析为 TextNode 了。 结合上面朋友的 whois 信息，网址是在 2024/12/09 注册，有理由相信网站是在 2024 年 11 月开发的。

If I understand Ralf's example right, the core problem is: purity does not only affect sub-expression elimination (i.e. `a = foo(); b = foo() ==> a = foo(); b = a;`, which seems to be OK if we mark diverging function as pure, but it also affects statement reorder. Let's make a concrete example: fn check_we_are_good() { if !we_are_good() { panic!("We are not good"); } } fn load_secret_key() -> SecretKey { // Get secret key from somewhere in the memory } check_we_are_good(); let secret_key = load_secret_key(); `load_secret_key` is a pure function, which does not have any side-effects: it simply loads secret key from somewhere in the memory, or from some specially-designed register with specially-designed mechanism. If we mark `check_we_are_good` as pure, then compiler may reorder the statements, then even if we are not good, the secret key is still loaded, which leaves a small time interval that attackers could retrieve secret keys in the stack. If I understand it right, then we might should design some purity annotations that only affects sub-expression elimination without statement reordering?

Es wurde eine problematische Schwachstelle in yanyutao0402 ChanCMS bis 3.1.2 ausgemacht. Betroffen hiervon ist ein unbekannter Ablauf der Datei /sysApp/find. Mit der Manipulation des Arguments accessKey/secretKey mit unbekannten Daten kann eine information disclosure-Schwachst...