CVE-2021-22356

There is a weak secure algorithm vulnerability in Huawei products. A weak secure algorithm is used in a module. Attackers can exploit this vulnerability by capturing and analyzing the messages between devices to obtain information. This can lead to information leak.Affected product versions...

CVE-2021-22356

CVE-2021-22356 affects Huawei security devices and modules, including IPS Module V500R005C00SPC100/SPC200, NGFW Module V500R005C00SPC100/SPC200, Secospace USG6300/USG6500/USG6600, and USG9500. The vulnerability stems from use of a weak secure algorithm in a module that can be exploited by capturi...

Debian DLA-2826-1 : mbedtls - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2826 advisory. Several vulnerabilities were discovered in mbed TLS, a lightweight crypto and SSL/TLS library, which could result in denial of service, information disclosure or...

Multiple Huawei products weak security algorithm vulnerabilities

Huawei USG9500 is a data center firewall product, Huawei IPS Module is an Intrusion Prevention System IPS module, and NGFW Module is a Next Generation Firewall NGFW module. A security vulnerability exists in several Huawei products due to the use of weak security encryption algorithms when...

Oracle Linux 8 : gcc-toolset-10-annobin (ELSA-2021-4592)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-4592 advisory. 9.29-1.2 - Bump and rebuild for new gcc. 2017782 9.29-1.1 - Annocheck: Add test for multibyte characters in symbol names. 2009282 Tenable has extracted the...

Oracle Linux 8 : annobin (ELSA-2021-4593)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4593 advisory. 9.72-1.2 - Bump NVR and rebuild to use the new gcc. 2017362 9.72-1.1 - Annocheck: Add test for multibyte characters in symbol names. 2017362 9.72-1 - Rebase to...

Oracle Linux 8 : rust-toolset:ol8 (ELSA-2021-4590)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4590 advisory. rust 1.54.0-3 - Lint against Unicode control codepoints. rust-toolset 1.54.0-1 - Update to Rust and Cargo 1.54.0. 1.53.0-1 - Update to Rust and Cargo 1.53.0...

Oracle Linux 8 : gcc-toolset-11-annobin (ELSA-2021-4591)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4591 advisory. 9.85-1.1 - Annocheck: Add test for multibyte characters in symbol names. 2017367 Tenable has extracted the preceding description block directly from the Oracle...

Philips Patient Information Center iX (PIC iX) and Efficia CM Series

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable from adjacent network/low attack complexity Vendor: Philips Equipment: Patient Information Center iX PIC iX and Efficia CM Series Vulnerabilities: Improper Input Validation, Use of Hard-coded Cryptographic Key, Use of a Broken or Risky...

Unspecified Vulnerability in IBM Tivoli Key Lifecycle Manager

IBM Tivoli Key Lifecycle Manager TKLM is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. A security vulnerability exists in IBM Tivoli Key Lifecycle Manager that stems fr...

IBM Tivoli Key Lifecycle Manager Information Disclosure Vulnerability (CNVD-2021-91635)

IBM Tivoli Key Lifecycle Manager TKLM is a set of key lifecycle management software from IBM Corporation. The software provides key storage, key maintenance, and key lifecycle management for storage devices.A security vulnerability exists in IBM Tivoli Key Lifecycle Manager, which stems from the...

Unclear TwapOracle.consult algorithm

Handle cmichel Vulnerability details The TWAPOracle.consult function is unclear to the auditor. It seems to iterate through all registered pairs that share the token parameter USDV or VADER and then sums up the foreign token pair per token price. And divides this sum sumNative by the summed-up US...

Improper hashing in enrocrypt

Impact The vulnerability is we used MD5 hashing Algorithm In our hashing file. If anyone who is a beginnerand doesn't know about hashes can face problems as MD5 is considered a Insecure Hashing Algorithm. Patches The vulnerability is patched in v1.1.4 of the product, the users can upgrade to...

GHSA-35M5-8CVJ-8783 Improper hashing in enrocrypt

Impact The vulnerability is we used MD5 hashing Algorithm In our hashing file. If anyone who is a beginnerand doesn't know about hashes can face problems as MD5 is considered a Insecure Hashing Algorithm. Patches The vulnerability is patched in v1.1.4 of the product, the users can upgrade to...

The vulnerability of the bidirectional algorithm in the implementation of Unicode standards, related to errors in code generation, allows a violator to execute arbitrary codes.

The vulnerability of the bidirectional algorithm in the implementation of Unicode is related to errors in code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

openssh: Observable discrepancy leading to an information leak in the algorithm negotiation

A flaw was found in OpenSSH in versions 5.7 through 8.3, where an Observable Discrepancy occurs and leads to an information leak in the algorithm negotiation. This flaw allows a man-in-the-middle attacker to target initial connection attempts, where there is no host key for the server that has be...

Moderate: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Security Tool Guts: How Much Should Customers See?

Many cybersecurity tools use engines that calculate risk for events in customer environments. The accuracy of these risk engines is a major concern for customers, since it determines whether an attack is detected or not. Therefore, organizations often request visibility into how a risk engine...

Low: libsolv security and bug fix update

The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fixes: libsolv: heap-based buffer overflow in testcaseread in src/testcase.c CVE-2021-3200 For more details about the security issues, including the impact, a CVSS score,...

Moderate: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Observable discrepancy leading to an information leak in the algorithm negotiation...