CVE-2021-25763: Use of a Broken or Risky Cryptographic Algorithm

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default...

PT-2021-14947

Name of the Vulnerable Software and Affected Versions: Huawei USG9500 versions V500R001C30SPC200, V500R001C60SPC500, V500R005C00SPC200 Huawei USG9520 version V500R005C00 Huawei USG9560 version V500R005C00 Huawei USG9580 version V500R005C00 Description: The issue is related to an insecure algorith...

Security Advisory - Information Leakage Vulnerability in Huawei Products

There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. Attackers can exploit this vulnerability by brute forcing to obtain sensitive message. This can lead to information leak. Vulnerability ID: HWPSIRT-2020-74955 This vulnerability ha...

Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2021-1159)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SolarWinds Hack Prompts Congress to Put NSA in Encryption Hot Seat

Members of Congress are demanding the U.S. National Security Agency NSA reveal what it knows about the 2015 Juniper Networks supply-chain delivery breach. In a letter sent by U.S. Senator Ron Wyden and nine additional members of Congress, the lawmakers demand a full account of the NSA-designed...

What tracking an attacker email infrastructure tells us about persistent cybercriminal operations

From March to December 2020, we tracked segments of a dynamically generated email infrastructure that attackers used to send more than a million emails per month, distributing at least seven distinct malware families in dozens of campaigns using a variety of phishing lures and tactics. These...

EulerOS 2.0 SP8 : openssh (EulerOS-SA-2021-1159)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows...

Huawei Mate 30 Weak Algorithm Vulnerability (CVE-2021-22307)

Huawei Mate 30 is a smartphone from the Chinese company Huawei Huawei. A weak algorithm vulnerability exists in Huawei Mate 30 version 10.0.0.203 C00E201R7P2. The vulnerability stems from the program not adequately protecting against protected modules. A local attacker could exploit the...

CentOS 8 : openssl (CESA-2019:3700)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3700 advisory. - openssl: timing side channel attack in the DSA signature algorithm CVE-2018-0734 - openssl: timing side channel attack in the ECDSA signature...

Security Advisory - Weak Algorithms Vulnerability in Huawei Smartphone

There is a weak algorithm vulnerability in Huawei smartphone. The protection is insufficient for the modules that should be protected. Local attackers can exploit this vulnerability to affect the integrity of certain module. Vulnerability ID: HWPSIRT-2020-37421 This vulnerability has been assigne...

How Page Integrity Manager Detects Real-World Magecart Attacks

Written by Ziv Eli - Engineering Manager, Security and Maor Hod - Senior Product Manager, Security In this blog, we will take a look at and break down a recent Magecart attack detected and mitigated by Page Integrity Manager. The impacted customer operates a large international e-commerce busines...

Dnsmasq Security Feature Issue Vulnerability (CNVD-2021-16430)

Dnsmasq is a lightweight DNS forwarding and DHCP, TFTP server written in C. It can be used as a server to forward DNS, DHCP, and TFTP. Dnsmasq suffers from a security vulnerability that stems from the use of a weak hash algorithm CRC32 to validate DNS responses when compiled without dnnssec. No...

IBM Security Identity Governance and Intelligence Weak Encryption Algorithm Vulnerability

IBM Security Identity Governance and Intelligence is an integrated identity management solution based on network devices. A weak cryptographic algorithm vulnerability exists in IBM Security Identity Governance and Intelligence 5.2.6. An attacker could exploit this vulnerability to decrypt highly...

CVE-2020-36201: Use of a Broken or Risky Cryptographic Algorithm

An issue was discovered in certain Xerox WorkCentre products. They do not properly encrypt passwords. This affects 3655, 3655i, 58XX, 58XXi 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices...

CVE-2020-4968: Use of a Broken or Risky Cryptographic Algorithm

IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192427...

IBM Security Identity Governance and Intelligence 加密问题漏洞

IBM Security Identity Governance and Intelligence is an integrated identity management solution based on network devices. A weak cryptographic algorithm vulnerability exists in IBM Security Identity Governance and Intelligence 5.2.6. An attacker could exploit this vulnerability to decrypt highly...

dnsmasq 加密问题漏洞

Dnsmasq is a lightweight DNS forwarding and DHCP, TFTP server written in C. It can be used as a server to forward DNS, DHCP, and TFTP. Dnsmasq suffers from a security vulnerability that stems from the use of a weak hash algorithm CRC32 to validate DNS responses when compiled without dnnssec. No...

dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker

A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in forward.c:replyquery, which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is...

Exploit for Improper Certificate Validation in Microsoft

CurveBall CVE-2020-0601 - PoC This vulnerability, known as...

IBM Security Guardium Data Encryption Weak Encryption Algorithm Vulnerability

IBM Security Guardium Data Encryption GDE provides a modular set of encryption solutions that help security teams effectively implement data-at-rest security across the organization. A weak cryptographic algorithm vulnerability exists in IBM Security Guardium Data Encryption 3.0.0.2. An attacker...