IBM Security Verify encryption issue vulnerability

IBM Security VerifyAccess ISAM is a service from IBM USA that improves user access security. The service enables secure and simple access to platforms such as Web, mobile, IoT, and cloud technologies through the use of risk-based access, single sign-on, integrated access management controls,...

Researchers Decrypted Qakbot Banking Trojan's Encrypted Registry Keys

Cybersecurity researchers have decoded the mechanism by which the versatile Qakbot banking trojan handles the insertion of encrypted configuration data into the Windows Registry. Qakbot, also known as QBot, QuackBot and Pinkslipbot, has been observed in the wild since 2007. Although mainly...

CVE-2021-3979

A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks...

CVE-2021-40006

Vulnerability of design defects in the security algorithm component. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2021-40006

Vulnerability of design defects in the security algorithm component. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2021-40006

Vulnerability of design defects in the security algorithm component. Successful exploitation of this vulnerability may affect confidentiality...

Design/Logic Flaw

Vulnerability of design defects in the security algorithm component. Successful exploitation of this vulnerability may affect confidentiality...

IBM Security Verify 加密问题漏洞

IBM Security VerifyAccess ISAM is a service from IBM USA that improves user access security. The service enables secure and simple access to platforms such as Web, mobile, IoT, and cloud technologies through the use of risk-based access, single sign-on, integrated access management controls,...

GHSA-XHW6-HJC9-679M Pac4j token validation bypass if OpenID Connect provider supports none algorithm

If an OpenID Connect provider supports the “none” algorithm i.e., tokens with no signature, pac4j v5.3.0 and prior does not refuse it without an explicit configuration on its side or for the “idtoken” response type which is not secure and violates the OpenID Core Specification. The "none" algorit...

Pac4j token validation bypass if OpenID Connect provider supports none algorithm

If an OpenID Connect provider supports the “none” algorithm i.e., tokens with no signature, pac4j v5.3.0 and prior does not refuse it without an explicit configuration on its side or for the “idtoken” response type which is not secure and violates the OpenID Core Specification. The "none" algorit...

CVE-2021-40006

Vulnerability of design defects in the security algorithm component. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2021-40006

CVE-2021-40006 is linked in connected documents to Huawei HarmonyOS Wearables encryption-related vulnerability, described as a design/logic flaw in the security algorithm component with potential confidentiality impact. The explicit details across sources confirm a design defect affecting confide...

Insecure Token

Pac4j has insecure token. The vulnerability exists due to an insecure validation of ID token with "none" algorithm allowing an attacker to bypass the token validation by injecting a maliciously crafted ID token by setting the alg key = "none"...

PT-2022-11130 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns design defects in the security algorithm component. Successful exploitation may affect confidentiality. Recommendations: At the moment, there is no information...

GHSA-5R5W-H76P-M726 Use of a Broken or Risky Cryptographic Algorithm in Max Mazurov Maddy

A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive information...

Use of a Broken or Risky Cryptographic Algorithm in Max Mazurov Maddy

A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive information...

Use of a Broken or Risky Cryptographic Algorithm in crypto2

The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to std::slice::fromrawpartsmut, which breaks the contract and introduces undefined behavior. This affects Chacha20 encryption and decryption in crypto2...

CVE-2021-44878

If an OpenID Connect provider supports the "none" algorithm i.e., tokens with no signature, pac4j v5.3.0 and prior does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none" algorit...

CVE-2021-45458

Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their passwor...

CVE-2021-44878

If an OpenID Connect provider supports the "none" algorithm i.e., tokens with no signature, pac4j v5.3.0 and prior does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none" algorit...