CVE-2023-42419

The CVE-2023-42419 issue affects Cybellum's Maintenance Server in the QCOW air-gapped distribution (China Edition) for versions 2.15.5 through 2.27. It was compiled with a hard-coded private cryptographic key, enabling an attacker with administrative privileges and access to the air-gapped server...

golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.

A flaw was found in the Golang crypto/tls standard library. In previous versions, the package was vulnerable to a Timing Side Channel attack by observing the time it took for RSA-based TLS key exchanges, which was not constant. This flaw allows a malicious user to gather information from the...

CVE-2024-1920

A vulnerability, which was classified as critical, has been found in osuuu LightPicture up to 1.2.2. This issue affects the function handle of the file /app/middleware/TokenVerify.php. The manipulation leads to use of hard-coded cryptographic key . The attack may be initiated remotely. The...

CVE-2024-1920

Summary: CVE-2024-1920 affects osuuu LightPicture

CVE-2024-1920 osuuu LightPicture TokenVerify.php handle hard-coded key

A vulnerability, which was classified as critical, has been found in osuuu LightPicture up to 1.2.2. This issue affects the function handle of the file /app/middleware/TokenVerify.php. The manipulation leads to use of hard-coded cryptographic key . The attack may be initiated remotely. The...

CVE-2024-1920 osuuu LightPicture TokenVerify.php handle hard-coded key

A vulnerability, which was classified as critical, has been found in osuuu LightPicture up to 1.2.2. This issue affects the function handle of the file /app/middleware/TokenVerify.php. The manipulation leads to use of hard-coded cryptographic key . The attack may be initiated remotely. The...

CVE-2023-6451

Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the application's authentication mechanisms...

Authentication flaw

Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the application's authentication mechanisms...

PT-2024-14960 · Alayacare · Procura Portal

Name of the Vulnerable Software and Affected Versions: AlayaCare's Procura Portal versions prior to 9.0.1.2 Description: The issue is related to a publicly known cryptographic machine key in AlayaCare's Procura Portal, which allows attackers to forge their own authentication cookies and bypass th...

CVE-2024-22313

Affected product: IBM Storage Defender - Resiliency Service (2.0). Root cause: hard-coded credentials used for inbound authentication, outbound communication, or internal data encryption. Impact (as stated): information disclosure with local access risk (confidentiality impact). Remediation: IBM’...

CVE-2024-22313 IBM Storage Defender - Resiliency Service information disclosure

IBM Storage Defender - Resiliency Service 2.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 278749...

CVE-2024-1258

A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file api/config/params.php of the component API. The manipulation of the argument JWTKEYADMIN leads to use of hard-coded cryptographic k...

Hardcoded credentials

A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file api/config/params.php of the component API. The manipulation of the argument JWTKEYADMIN leads to use of hard-coded cryptographic k...

CVE-2024-1258 Juanpao JPShop API params.php hard-coded key

A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file api/config/params.php of the component API. The manipulation of the argument JWTKEYADMIN leads to use of hard-coded cryptographic k...

CVE-2024-1258

Juanpao JPShop API (component API) has a vulnerability in api/config/params.php where manipulating the JWT_KEY_ADMIN leads to use of a hard-coded cryptographic key. Affected versions: up to 1.5.02. The issue is tied to hard-coded keys, with reported high confidentiality impact and high attack com...

CVE-2023-51840

DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...

CVE-2023-51840

DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...

CVE-2023-51840

Affected software: DoraCMS 2.1.8 (Node.js stack with Egg.js and MongoDB, per CNNVD/CVE context). Vulnerability: Use of a hard-coded cryptographic key, leading to exposure of sensitive data and potential tampering. Root cause (as stated): Hard-coded cryptographic key within DoraCMS 2.1.8. Impact (...

CVE-2023-51840

DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...

Hardcoded credentials

IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 275671...