Fortinet FortiWeb Multiple cryptographic flaws allow for full LDAP and RADIUS passwords compromise (FG-IR-20-222)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-20-222 advisory. - A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox...

Watermark for LLM-Generated Text

Researchers at Google have developed a watermark for LLM-generated text. The basics are pretty obvious: the LLM chooses between tokens partly based on a cryptographic key, and someone with knowledge of the key can detect those choices. What makes this hard is 1 how much text is required for the...

CVE-2024-38314

IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker that has compromised environment...

CVE-2024-38314

IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker that has compromised environment...

CVE-2024-38314 IBM Maximo Application Suite - Monitor Component information disclosure

IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker that has compromised environment...

CVE-2024-38314

CVE-2024-38314 affects IBM Maximo Application Suite - Monitor Component (versions 8.10, 8.11, 9.0). The root cause is a hard-coded cryptographic key that could disclose secret information to an attacker in a compromised environment, leading to information disclosure. IBM’s advisory lists remediat...

CVE-2024-38314 IBM Maximo Application Suite - Monitor Component information disclosure

IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker that has compromised environment...

b4ae (>=2.0.0, <=2.1.3), clatter (>=0.1.2-alpha, <=2.0.0-rc.1) +28 more potentially affected by unknown CVE via pqcrypto-kyber (>=0.1.2, <=0.8.1)

pqcrypto-kyber CARGO version =0.1.2, =2.0.0, =0.1.2-alpha, =0.1.4, =0.1.1, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.5.0 - qudag-exchange 0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0381...

Improper Authentication

matrix-js-sdk is vulnerable to Improper Authentication. The vulnerability is due to the method sendSharedHistoryKeys sends historical message keys to all devices of an invited user without checking if the user's cryptographic identity is verified or if the devices are signed by that identity,...

PT-2024-27939 · Ibm · Ibm Maximo Application Suite - Monitor

Name of the Vulnerable Software and Affected Versions: IBM Maximo Application Suite - Monitor Component versions 8.10 through 9.0 Description: The issue could disclose information in the form of a hard-coded cryptographic key to an attacker that has compromised the environment. Recommendations: F...

Dell Secure Connect Gateway Encryption Issue Vulnerability (CNVD-2024-41686)

The Dell Secure Connect Gateway Dell SCG is a secure connectivity gateway from Dell, USA. A cryptographic issue vulnerability exists in Dell Secure Connect Gateway version 5.24.00.14, which arises from the use of a corrupted or risky encryption algorithm, and can be exploited by a low-privileged...

PT-2024-10292 · Samsung · Smart Switch Pc

The software that is vulnerable is SmartSwitch, specifically versions prior to the SMR December 2024 Release 1. The vulnerability is related to the improper verification of cryptographic signatures, which allows local attackers to install malicious applications. This vulnerability has been assign...

Improper Verification Of Cryptographic Signature

elliptic is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to improper handling of the truncateToN function, which fails to correctly verify signatures when the hash contains at least four leading zero bytes and the elliptic curve's base point order is...

Improper Verification Of Cryptographic Signature

org.keycloak, keycloak-saml-core is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to flawed logic in the XMLSignatureUtil class's signature validation method, which fails to properly assess the scope of the SAML signature, allowing an attacker to create...

@0xcleon/dain-bridge-sdk (>=1.0.0, <=1.0.17), @0xcleon/wormhole-sdk (>=0.1.0, <=0.10.19) +998 more potentially affected by CVE-2024-48930 via secp256k1 (>=3.0.1, <=3.8.0)

secp256k1 NPM version =3.0.1, =1.0.0, =0.1.0, =0.0.1, =1.0.2, =0.1.0, =0.0.1, =0.0.3, =1.0.2, =1.1.0, =0.0.3, =0.0.1, =1.35.0, =0.13.3, =0.13.2, =7.16.1 and more Source cves: CVE-2024-48930 Source advisory: OSV:GHSA-584Q-6J8J-R5PM...

@0xvitto/context (>=0.1.0, <=0.1.1), @1001-digital/components.evm (>=1.3.0, <=4.0.3) +720 more potentially affected by CVE-2024-48930 via secp256k1 (5.0.0)

secp256k1 NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on secp256k1 and may be impacted: - @0xvitto/context =0.1.0, =1.3.0, =0.1.0, =1.2.2, =0.0.3, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =0.1.3, =0.1.0-alpha.20260610213851.5857f96, =1.0.1 an...

@0day-network/mod-renderer (>=0.1.0, <=0.1.1), @0day-network/react-sdk (>=0.0.1, <=0.2.1) +792 more potentially affected by CVE-2024-48930 via secp256k1 (>=4.0.0, <=4.0.3)

secp256k1 NPM version =4.0.0, =0.1.0, =0.0.1, =1.0.21, =1.0.6, =1.0.2, =0.1.0, =0.1.0, =0.2.0, =0.4.0, =0.4.1 - @aloe2/abstract-eth 1.0.20228282226 - @aloe2/account-lib 2.20.20228282226 - @aloe2/bitgo 14.2.20228282226 - @aloe2/sdk-coin-avaxc 1.1.20228282226 - @aloe2/sdk-coin-bsc 1.0.20228282226 a...

Researchers Discover Severe Security Flaws in Major E2EE Cloud Storage Providers

Cybersecurity researchers have discovered severe cryptographic issues in various end-to-end encrypted E2EE cloud storage platforms that could be exploited to leak sensitive data. "The vulnerabilities range in severity: in many cases a malicious server can inject files, tamper with file data, and...

PT-2024-7940

Name of the Vulnerable Software and Affected Versions Botan versions prior to 3.6.0 Description The issue is related to a compiler-induced secret-dependent operation in the lib/utils/donna128.h component of the Botan cryptographic library. This can lead to information disclosure through...

CVE-2024-10128

A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been rated as problematic. Affected by this issue is some unknown functionality of the file td.js.gz. The manipulation leads to risky cryptographic algorithm. The attack may be launched remotely. The exploit has been...