Information disclosure

An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE images and obtain sensitive information contained in them such as private cryptographic keys. This issue was found during internal product...

CVE-2016-4924

An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE images and obtain sensitive information contained in them such as private cryptographic keys. This issue was found during internal product...

Command injection

Version 4.40 of the TPM Trusted Platform Module firmware on Juniper Networks SRX300 Series has a weakness in generating cryptographic keys that may allow an attacker to decrypt sensitive information in SRX300 Series products. The TPM is used in the SRX300 Series to encrypt sensitive configuration...

CVE-2017-10606

Version 4.40 of the TPM Trusted Platform Module firmware on Juniper Networks SRX300 Series has a weakness in generating cryptographic keys that may allow an attacker to decrypt sensitive information in SRX300 Series products. The TPM is used in the SRX300 Series to encrypt sensitive configuration...

CVE-2016-4924 vMX: Information leak vulnerability

An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE images and obtain sensitive information contained in them such as private cryptographic keys. This issue was found during internal product...

CVE-2017-10606

The CVE-2017-10606 entry concerns Juniper Networks SRX300 Series firewall TPM firmware 4.40. Connected CNVD-2017-32096 describes a vulnerability in TPM key generation that could allow an attacker to decrypt sensitive configuration data, affecting the SRX300 Series and no other platforms. The root...

October Patch Tuesday: 28 Critical Microsoft Vulnerabilities

Today Microsoft released patches covering 62 vulnerabilities as part of October’s Patch Tuesday update, with 30 of them affecting Windows. Patches covering 28 of these vulnerabilities are labeled as Critical, and 33 can result in Remote Code Execution. According to Microsoft, a vulnerability in...

EulerOS 2.0 SP1 : nss, nspr, nss-softokn, nss-util (EulerOS-SA-2016-1017)

According to the versions of the nss, nspr, nss-softokn, nss-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A use-after-free flaw was found in the way NSS handled DHE Diffie-Hellman key exchange and ECDHE Elliptic Curve...

The vulnerability of the Safari browser, which allows a hacker to gain access to cryptographic keys

The vulnerability of the Safari Login AutoFill component in the Safari browser is related to the lack of protection for service data. Exploiting this vulnerability could allow a local attacker to obtain access to cryptographic keys using uncertain vectors...

The vulnerability of the iOS operating system, which allows a hacker to read data from the swap buffer

The vulnerability of the Pasteboard component in the iOS operating system is related to errors in managing cryptographic keys. Exploiting this vulnerability allows a local attacker to read data from the swap buffer using the encryption key obtained from the hardware UID...

Red Lion Controls Sixnet-Managed Industrial Switches, AutomationDirect STRIDE-Managed Ethernet Switches Vulnerability

CVSS v3 10 ATTENTION: Remotely exploitable. Low skill level is needed to exploit. Vendor: Red Lion Controls, AutomationDirect Equipment: Sixnet-Managed Industrial Switches and STRIDE-Managed Ethernet Switches Vulnerability: Use of Hard-coded Cryptographic Keys AFFECTED PRODUCTS The following Red...

PYSEC-2017-28

python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys...

WolfSSL Information Disclosure Vulnerability (CNVD-2016-12622)

WolfSSL formerly known as CyaSSL is the United States WolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in the C software implementation of RSA in WolfSSL 3.9.8 and earlier versions. A local attacker can...

Juniper Junos vMX 14.1 < 14.1R8 / 15.1 < 15.1F5 Local Information Disclosure (JSA10766)

According to its self-reported version number and architecture, the remote Juniper Junos vMX Virtual MX Series router is 14.1 prior to 14.1R8 or 15.1 prior to 15.1F5. It is, therefore, affected by a local information disclosure vulnerability due to the use of incorrect permissions. A local attack...

Juniper Networks Junos OS vMX Information Leak Vulnerability

Junos OS on vMX is prone to an information leak vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if...

Number of Devices Sharing Private Crypto Keys Up Sharply

Researchers at SEC Consult say the number of internet gateways, routers, modems and other embedded devices sharing cryptographic keys and certificates is up 40 percent since the Austrian consulting firm first looked at the problem in November. The report, posted Tuesday called “House of Keys,”...

Core Tor Contributor Leaves Project; Shutting Down Important Tor Nodes

Another blow to the Tor Project: One of the Tor Project's earliest contributors has decided to quit the project and shut down all of the important Tor nodes under his administration. Lucky Green was part of the Tor Project before the anonymity network was known as TOR. He probably ran one of the...

Netgear D6000 and D3600 contain hard-coded cryptographic keys and are vulnerable to authentication bypass

Overview The Netgear D6000 and D3600 routers are vulnerable to authentication bypass and contain hard-coded cryptographic keys embedded in their firmware. Description CWE-321: Use of Hard-coded Cryptographic Key -- CVE-2015-8288The firmware for these devices contains a hard-coded RSA private key,...

Scientific Linux Security Update : nss and nspr on SL5.x i386/x86_64 (20160425)

The following packages have been upgraded to a newer upstream version: nss 3.21.0, nspr 4.11.0. Security Fixes : - A use-after-free flaw was found in the way NSS handled DHE Diffie- Hellman key exchange and ECDHE Elliptic Curve Diffie-Hellman key exchange handshake messages. A remote attacker cou...

Scientific Linux Security Update : nss, nss-util, and nspr on SL6.x i386/x86_64 (20160405)

The following packages have been upgraded to a newer upstream version: nss 3.21.0, nss-util 3.21.0, nspr 4.11.0. Security Fixes : - A use-after-free flaw was found in the way NSS handled DHE Diffie- Hellman key exchange and ECDHE Elliptic Curve Diffie-Hellman key exchange handshake messages. A...