9840 matches found
CVE-2024-22005
there is a possible Authentication Bypass due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Authentication flaw
In TBD of TBD, there is a possible Authentication Bypass due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-22005
there is a possible Authentication Bypass due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-22005
there is a possible Authentication Bypass due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-22005
CVE-2024-22005 affects Google Pixel devices, categorized under the Pixel bulletin as a WLAN-related Elevation of Privilege vulnerability. The root cause is described as an authentication bypass due to improperly used cryptography, enabling local privilege escalation without user interaction. No p...
PT-2024-19147 · Google · Android
Name of the Vulnerable Software and Affected Versions: TBD affected versions not specified Description: The issue is related to an Authentication Bypass due to improperly used crypto, which could lead to local escalation of privilege with no additional execution privileges needed. User interactio...
Unbreakable Enterprise kernel security update
5.15.0-204.147.6.2 - smb3: Replace smb2pdu 1-element arrays with flex-arrays Kees Cook Orabug: 36353543 - hvnetvsc: Register VF in netvscprobe if NETDEVICEREGISTER missed Shradha Gupta Orabug: 36358874 - hvnetvsc: Fix race condition between netvscprobe and netvscremove Souradeep Chakrabarti -...
Fedora: Security Advisory for crypto-policies (FEDORA-2024-129d8ca6fc)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 40 Update: crypto-policies-20240201-2.git9f501f3.fc40
This package provides pre-built configuration files with cryptographic policies for various cryptographic back-ends, such as SSL/TLS libraries...
[SECURITY] Fedora 40 Update: bouncycastle-1.70-13.fc40
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Installation Manager and IBM Packaging Utility
Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 8 used by IBM Installation Manager and IBM Packaging Utility. The IBM Installation Manager and IBM Packaging Utility have addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2024-20952 DESCRIPTION: An...
Security Bulletin: Vulnerability in go affect IBM Cloud Pak System
Summary Vulnerability in go affect IBM Cloud Pak System. Vulnerability Details CVEID:CVE-2023-45287 DESCRIPTION: Golang Go could allow a remote attacker to obtain sensitive information, caused by a timing-side channel attack in the RSA based key exchange methods in crypto/tls. The removal of of...
Hacked WordPress Sites Abusing Visitors' Browsers for Distributed Brute-Force Attacks
Threat actors are conducting brute-force attacks against WordPress sites by leveraging malicious JavaScript injections, new findings from Sucuri reveal. The attacks, which take the form of distributed brute-force attacks, "target WordPress websites from the browsers of completely innocent and...
Golang < 1.21.8, 1.22.x < 1.22.1 Multiple Vulnerabilities
The version of Golang running on the remote host is prior to 1.21.8 or 1.22.x prior to 1.22.1. It is, therefore, is affected by multiple vulnerabilities: - A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded. CVE-2023-45289 - Verifying a certificate chai...
Hackers Exploit Misconfigured YARN, Docker, Confluence, Redis Servers for Crypto Mining
Threat actors are targeting misconfigured and vulnerable servers running Apache Hadoop YARN, Docker, Atlassian Confluence, and Redis services as part of an emerging malware campaign designed to deliver a cryptocurrency miner and spawn a reverse shell for persistent remote access. "The attackers...
BIT-GOLANG-2021-34558
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic...
BIT-NODE-2022-35255
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/cryptokeygen.cc. There are two problems with this: 1 It does not check the return value, it assumes EntropySource always succeeds, but it can a...
BIT-GOLANG-2022-23806
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element...
BIT-GOLANG-2022-27536
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic...