The vulnerability of the CAPICOM cryptographic module, related to errors in code generation, allows a perpetrator to execute arbitrary code.

The vulnerability of the CAPICOM cryptographic module is related to errors in code generation control. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Side-channel Attack

httpd is vulnerable to side-channel attack. An implementation flaw was discovered in multiple cryptographic libraries that allows a side-channel based attacker to recover ECDSA or DSA private keys. When these cryptographic libraries use the private key to create a signature, such as for a TLS or...

Fedora Update for cryptopp FEDORA-2019-812b77ed2e

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: cryptopp-8.2.0-1.fc30

Crypto++ Library is a free C++ class library of cryptographic schemes. See http://www.cryptopp.com/ for a list of supported algorithms. One purpose of Crypto++ is to act as a repository of public domain not copyrighted source code. Although the library is copyrighted as a compilation, the...

The vulnerability of the PA-RISC CRYPTO_memcmp function in the OpenSSL library, which allows attackers to create fake messages

The vulnerability of the PA-RISC CRYPTOmemcmp function in the OpenSSL library is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to create fake messages that will be treated as authentic...

CVE-2019-4256

IBM API Connect 5.0.0.0 through 5.0.8.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 159944...

Code injection

IBM API Connect 5.0.0.0 through 5.0.8.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 159944...

CVE-2019-4256

IBM API Connect is affected by CVE-2019-4256 for versions 5.0.0.0 through 5.0.8.6, where weaker cryptographic algorithms could allow decryption of highly sensitive information. The issue specifically affects the cryptographic implementation in API Connect. The recommended remediation is to upgrad...

CVE-2019-4256

IBM API Connect 5.0.0.0 through 5.0.8.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 159944...

Siemens LOGO! 8 Hard-Coded Cryptographic Key

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2019-012 Product: LOGO! Manufacturer: Siemens Affected Versions: LOGO! 8 all versions Tested Versions: LOGO! 8, 6ED1052-2MD00-0BA8 FS:03, 0BA8.Standard V1.08.03 Vulnerability Type: Use of Hard-coded Cryptographic Key CWE-321 Risk...

Siemens LOGO! 8 Hard-Coded Cryptographic Key Vulnerability

Due to the use of a hard-coded cryptographic key, an attacker can put the integrity and confidentiality of encrypted data of all Siemens LOGO! 8 PLCs using this key at risk, for instance decrypting network communication during a man-in-the-middle attack. Siemens LOGO! 8 Hard-Coded Cryptographic K...

F5 Networks BIG-IP : OpenSSL and Intel processor SMT side-channel vulnerability (PortSmash) (K49711130)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.2.1 / 15.0.0. It is, therefore, affected by a vulnerability as referenced in the K49711130 advisory. - Simultaneous Multi-threading SMT in processors can enable local users to exploit software vulnerable to timing...

Computrols CBAS Insufficient Encryption Strength Vulnerability

CBAS Web is a Web-based building management system BMS from Computrols. Computrols CBAS Web suffers from an insufficient encryption strength vulnerability. The vulnerability stems from the fact that this application stores passwords in a database using MD5 hashes, and the MD5 algorithm is...

IBM API Connect Information Disclosure Vulnerability (CNVD-2019-25511)

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. A vulnerability exists in IBM API Connect versions 5.0.0.0 through 5.0.8.6 for cryptographic...

Security Bulletin: IBM API Connect V5 is potentially impacted by a weak cipher (CVE-2019-4256)

Summary API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4256 DESCRIPTION: IBM API Connect uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base Score: 5.9 CVSS Temporal Score:...

On Verifiable Delay Functions - How to Slow Burning the Planet Down (Verifiably)

Update: you can find the Part II of this series here In this blog post I am going to talk about some really cool cryptographic research done by Luca De Feo, Simon Masson, Christophe Petit and myself around a relatively new cryptographic construction called Verifiable Delay Functions VDF from now...

W3 Total Cache Plugin for WordPress < 0.9.7.4 Multiple Vulnerabilities

The WordPress W3 Total Cache Plugin installed on the remote host is affected by multiple vulnerabilities : - A Cross-Site Scripting XSS vulnerability exists due to improper validation of user-supplied input in command parameter of /w3-total-cache/pub/opcache.php. - A Server Side Request Forgery...

Computrols CBAS Web

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Computrols Equipment: CBAS Web Vulnerabilities: Cross-site Request Forgery, Information Exposure Through Discrepancy, Cross-site Scripting, Command Injection, Information Exposure Through Source...

Debian DLA-1796-1 : jruby security update

Multiple vulnerabilities have been discovered in jruby, Java implementation of the Ruby programming language. CVE-2018-1000074 Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the gem owner...

The vulnerability of NSS libraries, related to errors in cryptographic transformations, allows attackers to gain unauthorized access to protected information.

The vulnerability of the NSS libraries is related to errors in cryptographic transformations. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...