1109 matches found
CVE-2019-1828: Use of a Broken or Risky Cryptographic Algorithm
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to access administrative credentials. The vulnerability exists because affected devices use weak encryption algorithms for use...
CVE-2019-7477: Use of a Broken or Risky Cryptographic Algorithm
A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher suites are enabled. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0...
CVE-2019-5919: Use of a Broken or Risky Cryptographic Algorithm
An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 5, and 5u1 to 5u13 allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors...
CVE-2019-1543: Use of a Broken or Risky Cryptographic Algorithm
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value IV should be 96 bits 12 bytes. OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also...
CVE-2019-9483: Use of a Broken or Risky Cryptographic Algorithm
Amazon Ring Doorbell before 3.4.7 mishandles encryption, which allows attackers to obtain audio and video data, or insert spoofed video that does not correspond to the actual person at the door...
CVE-2019-7006: Use of a Broken or Risky Cryptographic Algorithm
Avaya one-X Communicator uses weak cryptographic algorithms in the client authentication component that could allow a local attacker to decrypt sensitive information. Affected versions include all 6.2.x versions prior to 6.2 SP13...
CVE-2019-5754: Use of a Broken or Risky Cryptographic Algorithm
Implementation error in QUIC Networking in Google Chrome prior to 72.0.3626.81 allowed an attacker running or able to cause use of a proxy server to obtain cleartext of transport encryption via malicious network proxy...
OSCI-Transport Library 1.2 1.8.1 Insecure Crypto / Signature Bypass
A blog post with further information has been released on this topic as well: https://r.sec-consult.com/osci SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: OSCI-Transport Library 1.2...
CVE-2019-3818: Use of a Broken or Risky Cryptographic Algorithm
The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insecure ciphers and TLS 1.0. An attacker could target traffic sent over a TLS connection with a weak configuration and potentially break the...
PT-2019-5537 · Red Hat +2 · Red Hat +2
Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Linux kernel versions prior to 5.0 Description: A buffer over-read flaw was found in the crypto authenc extractkeys function in the crypto/authenc.c file of the IPsec Cryptographic algorithm's module, authenc. This issue...
Code injection
IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144653...
CVE-2018-7959: Use of a Broken or Risky Cryptographic Algorithm
There is a short key vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to intercept and decrypt the call information when the user enables SRTP to make a call. Successful exploitation may cause sensitive information leak...
CVE-2018-18587: Use of a Broken or Risky Cryptographic Algorithm
BigProf AppGini 5.70 stores the passwords in the database using the MD5 hash...
CVE-2018-16806: Use of a Broken or Risky Cryptographic Algorithm
A Pektron Passive Keyless Entry and Start PKES system, as used on the Tesla Model S and possibly other vehicles, relies on the DST40 cipher, which makes it easier for attackers to obtain access via an approach involving a 5.4 TB precomputation, followed by wake-frame reception and two...
Security Bulletin: IBM Content Collector for SAP Applications is affected by GSKit and GSKit-Crypto vulnerabilities
Summary IBM Content Collector for SAP Applications has addressed multiple GSKit and GSKit-Crypto vulnerabilities. Details of the vulnerabilities is mentioned below. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error...
Security Bulletin: Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products
Summary Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products. Vulnerability Details CVEID: CVE-2018-1447 DESCRIPTION: The GSKit CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak...
Security Bulletin: Vulnerabilities in IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products
Summary Vulnerabilities in IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error when parsing DSA private keys. An attacker could exploit this...
Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Use of a Broken or Risky Cryptographic Algorithm vulenrability (CVE-2017-1598)
Summary IBM Security Guardium Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM Security Guardium Database Activity Monitor has fixed this vulenrability Vulnerability Details CVEID: CVE-2017-1598...
Security Bulletin: API Connect is affected by weaker than expected cryptographic algorithm usage vulnerability (CVE-2018-1385)
Summary API Connect has addressed the following vulnerability. IBM API Connect uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Vulnerability Details CVEID: CVE-2018-1385 DESCRIPTION: IBM API Connect uses weaker than expected...