CVE-2024-6890: Use of Hard-coded Cryptographic Key

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password...

Exploit for Improper Restriction of Excessive Authentication Attempts in Logsign Unified_Secops_Platform

Logsign SIEM RCE Exploit CVE-2024-5716 & CVE-2024-5717 This...

CVE-2024-41260: Use of Hard-coded Cryptographic Key

A static initialization vector IV in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information email addresses when in possession of the audit events database...

Compromising the Secure Boot Process

This isnt good: On Thursday, researchers from security firm Binarly revealed that Secure Boot is completely compromised on more than 200 device models sold by Acer, Dell, Gigabyte, Intel, and Supermicro. The cause: a cryptographic key underpinning Secure Boot on those models that was compromised ...

CVE-2024-20323

A vulnerability in Cisco Intelligent Node iNode Software could allow an unauthenticated, remote attacker to hijack the TLS connection between Cisco iNode Manager and associated intelligent nodes and send arbitrary traffic to an affected device. This vulnerability is due to the presence of...

CVE-2024-20323: Use of Hard-coded Cryptographic Key

A vulnerability in Cisco Intelligent Node iNode Software could allow an unauthenticated, remote attacker to hijack the TLS connection between Cisco iNode Manager and associated intelligent nodes and send arbitrary traffic to an affected device. This vulnerability is due to the presence of...

PT-2024-5287 · Cisco · Cisco Intelligent Node

Name of the Vulnerable Software and Affected Versions: Cisco Intelligent Node iNode Software affected versions not specified Description: The issue is related to the use of a hard-coded cryptographic key in the software, which could allow a remote attacker to exploit the vulnerability and impact...

CVE-2024-36526

ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key...

CVE-2024-36526

ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key...

CVE-2024-36526: Use of Hard-coded Password

ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key...

CVE-2024-36526

ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key...

CVE-2024-38532: Use of Hard-coded Cryptographic Key

The NXP Data Co-Processor DCP is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcptool reference implementation included in the repository selected the test key, regardless of its -t argument. This...

Fortinet FortiClient Telemetry protocol is vulnerable to a MitM (FG-IR-21-075) (macOS)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-075 advisory. - A combination of a use of hard-coded cryptographic key vulnerability CWE-321 in FortiClientEMS 7.0.1 and below, 6.4.6 and...

Fortinet FortiClient Telemetry protocol is vulnerable to a MitM (FG-IR-21-075)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-075 advisory. - A combination of a use of hard-coded cryptographic key vulnerability CWE-321 in FortiClientEMS 7.0.1 and below, 6.4.6 and...

Logsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP API. The issue results from using a hard-coded...

CVE-2024-1275

Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52...

CVE-2024-1275 Vulnerability in Baxter Welch Allyn Connex Spot Monitor

Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52...

PT-2024-17726

Name of the Vulnerable Software and Affected Versions Welch Allyn Connex Spot Monitor versions prior to 1.52 Description The issue is related to the use of a default cryptographic key, which may allow configuration or environment manipulation. Recommendations For versions prior to 1.52, update to...

CVE-2024-1275: Use of Default Cryptographic Key

Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52...

D-Link TokenUtils Privilege Bypass

The vulnerability of the TokenUtils class in the D-Link D-View software platform for comprehensive network management is related to the use of a rigidly encrypted cryptographic key. Exploiting this vulnerability could allow an attacker to enhance their privileges by bypassing the authentication...