499 matches found
CVE-2023-42419 Improper Management of Cryptographic Keys in the Maintenance Server in QCOW Air-Gapped Distribution (China Edition)
Maintenance Server, in Cybellum's QCOW air-gapped distribution China Edition, versions 2.15.5 through 2.27, was compiled with a hard-coded private cryptographic key. An attacker with administrative privileges & access to the air-gapped server could potentially use this key to run commands on the...
Elink Smart eSmartCam Security Vulnerability
Elink Smart eSmartCam is a smart camera from Elink Smart. A security vulnerability exists in Elink Smart eSmartCam version 2.1.5, which stems from a vulnerability that allows an attacker to extract hard-coded AES encryption keys from a binary file...
GHSA-6F9G-CXWR-Q5JR Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character...
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character...
Buffalo VR-S1000 Security Vulnerability
The Buffalo VR-S1000 is a VPN router from Buffalo Japan. A security vulnerability exists in the Buffalo VR-S1000 version 2.37 and earlier, which stems from the use of hard-coded cryptographic keys, which allows an attacker to analyze the passwords of users of a specific product...
NATS Server Security Vulnerability
NATS Server is an open source messaging system. The system is primarily used for cloud-native applications, IoT messaging, and microservice architectures. A security vulnerability exists in NATS Server versions 2.10.0 through 2.10.3, and nkeys versions 0.4.0 through 0.4.5, which stems from the...
CVE-2022-26942
The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment TEE modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure superviso...
Design/Logic Flaw
The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment TEE modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure superviso...
CVE-2023-34039
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI...
VMware Aria Operations 加密问题漏洞
VMware Aria Operations is a unified, AI-powered, self-driving IT operations management platform for private, hybrid and multi-cloud environments from VMware. Aria Operations for Networks has a security vulnerability that stems from a lack of unique cryptographic key generation, resulting in an...
CVE-2023-23342
If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented...
Input validation
If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented...
CVE-2023-23342
CVE-2023-23342 affects HCL Nomad for Web . Malicious manipulation of local files can bypass the validation of cryptographic keys when accessing local data. CNNVD notes the vulnerability exists in Nomad prior to 1.0.7 . Impact is described as compromising cryptographic validation (confidentiality/...
PT-2023-18915 · Hcl +1 · Hcl Nomad For Web +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows the validation to use cryptographic keys to be circumvented if certain local files are manipulated in a specific manner. There is no...
CVE-2023-37858
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password...
CVE-2023-37857
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to...
Hardcoded credentials
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to...
Hardcoded credentials
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password...
CVE-2023-37858 PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password...