📄 eGovFramework 4.3.1 File Upload / Unauthenticated Encryption Oracle

eGovFramework versions 4.3.1 and below suffer from unauthenticated file upload and encryption oracle vulnerabilities. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory Information Title: 2 vulnerabilities in Egovframe Advisory URL: https://pierrekim.github.io/advisories/2025-egovframe.txt...

IBM Concert 加密问题漏洞

IBM Concert is a generative artificial intelligence-driven automated application management and monitoring tool based on the watsonx platform released in May 2024 by IBM. IBM Concert suffers from a cryptographic issue vulnerability that stems from not properly enabling HTTP Strict Transport...

CVE-2025-13316

Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to...

CVE-2025-13316

Twonky Server 8.5.2 on Linux and Windows is affected by CVE-2025-13316, a cryptographic flaw caused by hard-coded keys. An attacker who obtains the encrypted administrator password can decrypt it with the static keys to obtain the plaintext password and gain administrator-level access to Twonky S...

CVE-2025-52457

Observable Timing Discrepancy CWE-208 in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a distributed in 9.30.2881 MR3, 9.2...

PT-2025-47514

Name of the Vulnerable Software and Affected Versions Twonky Server version 8.5.2 Description Twonky Server version 8.5.2 on Linux and Windows contains a cryptographic flaw due to the use of hard-coded cryptographic keys. An attacker who knows the encrypted administrator password can decrypt it...

Improper Verification Of Cryptographic Signature

Apache Spark is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to the use of an unauthenticated default encryption cipher AES/CTR/NoPadding for RPC communication when spark.network.crypto.enabled is true and no cipher is explicitly configured, which allow...

Desktop Alert Unspecified Vulnerability in PingAlert (CNVD-2025-29434)

Desktop Alert PingAlert is a network status monitoring tool developed by DesktopAlert, Inc. and is mainly used to monitor the status of network devices in real time and send alerts. An unspecified vulnerability exists in Desktop Alert PingAlert, which arises from the presence of corrupt or insecu...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-56754)

crypto: vulnerability due to passing an incorrect parameter type to devmaddactionorreset in the CAAM driver, which is fixed by ensuring the correct parameter type is used to properly release resources. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-o...

ROS-20251117-04

A vulnerability in the LXD container and lightweight virtual machine management system is related to redundant API data output. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to potentially sensitive information The vulnerability in the LXD container and...

CVE-2025-9317 AVEVA Edge Use of a Broken or Risky Cryptographic Algorithm

The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes...

EUVD-2025-197637

A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There is a Broken or Risky Cryptographic Algorithm...

HSEC-2023-0002 Improper Verification of Cryptographic Signature

Improper Verification of Cryptographic Signature The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The version 2 of the specification mandate...

Cryptographic Failure Third-Party Dependency in Bitbucket Data Center and Server - CVE-2022-24771

This High severity vulnerability known as CVE-2022-24771 was introduced in 8.19.0, 8.19.1, 8.19.2, 8.19.3, 8.19.4, 8.19.5, 8.19.6, 8.19.7, 8.19.8, 8.19.9, 8.19.10, 8.19.11, 8.19.12, 8.19.13, 8.19.14, 8.19.15 of Bitbucket Data Center and Server. This vulnerability with a CVSS Score of 7.5 and a CV...

CVE-2025-54340

CVE-2025-54340 affects Desktop Alert PingAlert software, specifically the Application Server components in versions 6.1.0.11 through 6.1.1.2. The vulnerability is described as a Broken or Risky Cryptographic Algorithm, with an impact on confidentiality and a CVSSv3.1 base score of 4.1 (Medium). T...

CVE-2025-54340

A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There is a Broken or Risky Cryptographic Algorithm...

The Jasmin Compiler Preserves Cryptographic Security

Jasmin is a programming and verification framework for developing efficient, formally verified, cryptographic implementations. A main component of the framework is the Jasmin compiler, which empowers programmers to write efficient implementations of state-of-the-art cryptographic primitives,...

CVE-2025-54340

A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There is a Broken or Risky Cryptographic Algorithm...

EUVD-2025-175323

Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalation of privilege via local access...

Book Review: The Business of Secrets

The Business of Secrets: Adventures in Selling Encryption Around the World by Fred Kinch May 24, 2024 From the vantage point of today, it's surreal reading about the commercial cryptography business in the 1970s. Nobody knew anything. The manufacturers didn't know whether the cryptography they so...