Tenable SecurityCenter 5.9.x to 5.12.x SimpleSAMLPHP Privilege Escalation (TNS-2020-01)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is 5.9.x, 5.10.x, 5.11.x or 5.12.x. It is, therefore, affected by a privilege escalation vulnerability due to incorrect validation of cryptographic signatures in XML messages in the...

RHEL 7 : nss and nss-softokn (RHSA-2021:0876)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0876 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

nss: Check length of inputs for cryptographic primitives

A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability...

Cleartext storage of session identifier

User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system...

The vulnerability of the Samba networking communication package is related to deficiencies in the cryptographic security mechanism. This allows attackers to gain access to confidential data and compromise its integrity.

The vulnerability of the Samba networking communication package is related to deficiencies in the cryptographic security mechanism. Exploiting this vulnerability allows a remote attacker to gain access to confidential data and compromise its integrity...

IBM DataPower Gateway Weak Encryption Algorithm Vulnerability

IBM DataPower Gateway is a security and integration platform built specifically for mobile, cloud, API, web, SOA, B2B and cloud workloads. A weak cryptographic algorithm vulnerability exists in IBM DataPower Gateway 10.0.0.0 - 10.0.1.0. An attacker could exploit the vulnerability to decrypt highl...

The vulnerability of the signature verification function in Cisco SD-WAN vEdge Router software allows a attacker to compromise the integrity of protected information, as facilitated by the centralized network management system Cisco SD-WAN vManage.

The vulnerability of the signature verification function in Cisco SD-WAN vEdge Router software is related to errors in verifying the cryptographic signatures. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

The vulnerability of Google Chrome’s user interface allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Google Chrome browser user interface is related to errors in cryptographic transformations. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Google Chrome browser’s Network Internals interface allows attackers to gain unauthorized access to protected information.

The vulnerability of Google Chrome’s network internal interfaces is related to errors in cryptographic transformations. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the TabStrip function in Google Chrome’s browser, related to cryptographic transformation errors, allows a hacker to gain unauthorized access to protected information.

The vulnerability of the TabStrip function in Google Chrome browser is related to errors in cryptographic transformations. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Samba networking communication package is related to deficiencies in the cryptographic security mechanism, allowing attackers to gain access to confidential data.

The vulnerability of the Samba networking communication package is related to deficiencies in the cryptographic security mechanism. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

CompTIA Security Certification Prep — Lifetime Access for just $30

At long last, top companies are starting to take cybersecurity seriously. As a consequence, technical recruiters are looking for people with hacking skills and certifications to prove it. CompTIA is seen as the gold standard when it comes to cybersecurity exams, with several certifications to...

Security Advisory YSA-2021-03 | Yubico

A security update for pam-u2f resolves a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence touch or cryptographic signature verification to be bypassed, so an attacker would still need to...

CVE-2020-4831

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 189965...

Code injection

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 189965...

CVE-2020-4831

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 189965...

CVE-2020-4831

CVE-2020-4831 affects IBM DataPower Gateway 10.0.0.0–10.0.1.0, where weaker than expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. Connected IBM advisories confirm the vulnerability in DataPower Gateway and provide remediation: upgrade to IBM DataP...

Fast Random Bit Generation

Science has a paper and commentary on generating 250 random terabits per second with a laser. I dont know how cryptographically secure they are, but that can be cleaned up with something like Fortuna. EDITED TO ADD 3/12: Here are free versions of the paper and the commentary...

IBM DataPower Gateway 加密问题漏洞

IBM DataPower Gateway is a security and integration platform built specifically for mobile, cloud, API, web, SOA, B2B and cloud workloads. A weak cryptographic algorithm vulnerability exists in IBM DataPower Gateway 10.0.0.0 - 10.0.1.0. An attacker could exploit the vulnerability to decrypt highl...

EulerOS Virtualization 2.9.0 : nss (EulerOS-SA-2021-1640)

According to the versions of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In Network Security Services NSS before 3.46, several cryptographic primitives had missing length checks. In cases where the...