12117 matches found
CVE-2017-11427 Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal
OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authenticatio...
Code injection
IBM WebShere MQ 9.1.0.0, 9.1.0.1, 9.1.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 152925...
CVE-2018-1925
IBM WebShere MQ 9.1.0.0, 9.1.0.1, 9.1.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 152925...
CVE-2018-1925
CVE-2018-1925 affects IBM WebSphere MQ (and the MQ Console) versions 9.1.0.0, 9.1.0.1, and 9.1.1, where weaker-than-expected cryptographic algorithms could permit an attacker to decrypt highly sensitive information (man-in-the-middle risk). Connected IBM advisories corroborate affected ranges and...
NVIDIA Jetson TX1 and NVIDIA Jetson TX2 Encryption Issues Vulnerabilities
NVIDIA Jetson TX2 and NVIDIA Jetson TX1 are both products of NVIDIA Corporation.NVIDIA Jetson TX2 is an embedded system development module.NVIDIA Jetson TX1 is an embedded system development module.Linux for Tegra is a suite of Linux systems that run on it. Linux for Tegra is a Linux system that...
Security Bulletin: IBM MQ Console is vulnerable to a man in the middle attack (CVE-2018-1925)
Summary The IBM MQ Console is vulnerable to a man in the middle attack caused by weaker than expected cryptographic algorithms. Vulnerability Details CVEID: CVE-2018-1925 DESCRIPTION: IBM MQ uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv...
EulerOS Virtualization 2.5.3 : kernel (EulerOS-SA-2019-1221)
According to the version of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cach...
Google Android Qualcomm Closed Source Component Encryption Vulnerability
Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. A cryptographic vulnerability exists in the Qualcomm closed-source component of Android. No details of the vulnerability are provided at this time...
The vulnerability of the OpenSSL library, related to errors in cryptographic transformations, allows a hacker to disclose the protected information.
The vulnerability of the OpenSSL library is related to errors in cryptographic transformations. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...
A Go implementation of Poly1305 that makes sense
Poly1305 is a Message Authentication Code--a cryptographic primitive for authenticating a message with a shared secret key, like HMAC. Although its really a fraction of the complexity of e.g. elliptic curves, most of the implementations Ive read look decidedly like magic, mysteriously multiplying...
Debian DLA-1747-1 : firmware-nonfree security update
Eli Biham and Lior Neumann discovered a cryptographic weakness in the Bluetooth LE SC pairing protocol, called the Fixed Coordinate Invalid Curve Attack CVE-2018-5383. Depending on the devices used, this could be exploited by a nearby attacker to obtain sensitive information, for denial of servic...
Security Bulletin: API Connect V5 is impacted by weak cryptographic algorithms (CVE-2018-2007)
Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-2007 DESCRIPTION: IBM API Connect uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base Score: 5.9 CVSS Temporal...
Code injection
Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed X.509v3 key/certificate pairs. An unauthenticated remote attacker with the knowledge of the default keys may potentially be able to...
CVE-2019-3710
Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed X.509v3 key/certificate pairs. An unauthenticated remote attacker with the knowledge of the default keys may potentially be able to...
CVE-2019-3710
Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed X.509v3 key/certificate pairs. An unauthenticated remote attacker with the knowledge of the default keys may potentially be able to...
CVE-2019-3710
CVE-2019-3710 affects Dell EMC Networking OS10 before 10.4.3, where an application uses undocumented pre-installed X.509v3 key/certificate pairs. This cryptographic key vulnerability can allow an unauthenticated remote attacker with knowledge of the default keys to intercept communications or gai...
CVE-2019-3710 DSA-2019-034: Dell EMC Networking OS10 Undocumented Default Cryptographic Key Vulnerability
Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed X.509v3 key/certificate pairs. An unauthenticated remote attacker with the knowledge of the default keys may potentially be able to...
The vulnerability of the Cisco NX-OS network operating system for Cisco routers arises from incorrect verification of the cryptographic signature. This allows a perpetrator to load malicious software onto the system.
The vulnerability of the Cisco NX-OS network operating system for Cisco routers is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow a perpetrator to load malicious software into the system...
Hacking microcontroller firmware through a USB
In this article, I want to demonstrate extracting the firmware from a secure USB device running on the Cortex M0. Who hacks video game consoles? The manufacture of counterfeit and unlicensed products is widespread in the world of video game consoles. It's a multi-billion dollar industry in which...