CVE-2018-5387

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service...

CVE-2018-5387

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service...

CVE-2017-3225

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt...

CVE-2017-3225

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt...

CVE-2018-5387

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service...

CVE-2017-3225 Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector that may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt...

CVE-2018-5387

CVE-2018-5387 affects Wizkunde SAMLBase. Root cause: incorrect handling of XML DOM traversal/canonicalization APIs can cause SAML data to be manipulated without invalidating the cryptographic signature, enabling potential authentication bypass of SAML service providers. Affected Wizkunde SAMLBase...

New Bluetooth Hack Affects Millions of Devices from Major Vendors

Yet another bluetooth hacking technique has been uncovered. A highly critical cryptographic vulnerability has been found affecting some Bluetooth implementations that could allow an unauthenticated, remote attacker in physical proximity of targeted devices to intercept, monitor or manipulate the...

New Bluetooth Hack Affects Millions of Devices from Major Vendors

Yet another bluetooth hacking technique has been uncovered. A highly critical cryptographic vulnerability has been found affecting some Bluetooth implementations that could allow an unauthenticated, remote attacker in physical proximity of targeted devices to intercept, monitor or manipulate the...

Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange

Overview Bluetooth firmware or operating system software drivers may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device. Description CWE-325: Missi...

[SECURITY] Fedora 28 Update: python-cryptography-2.3-1.fc28

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...

[SECURITY] Fedora 27 Update: libtomcrypt-1.18.2-1.fc27

A comprehensive, modular and portable cryptographic toolkit that provides developers with a vast array of well known published block ciphers, one-way hash functions, chaining modes, pseudo-random number generators, public key cryptography and a plethora of other routines. Designed from the ground...

CVE-2017-1575

IBM Sterling B2B Integrator Standard Edition IBM Sterling File Gateway 2.2.0 through 2.2.6 uses weaker than expected cryptographic algorithms that could allow a local attacker to decrypt highly sensitive information. IBM X-Force ID: 132032...

Code injection

IBM Sterling B2B Integrator Standard Edition IBM Sterling File Gateway 2.2.0 through 2.2.6 uses weaker than expected cryptographic algorithms that could allow a local attacker to decrypt highly sensitive information. IBM X-Force ID: 132032...

CVE-2017-1575

IBM Sterling B2B Integrator Standard Edition IBM Sterling File Gateway 2.2.0 through 2.2.6 uses weaker than expected cryptographic algorithms that could allow a local attacker to decrypt highly sensitive information. IBM X-Force ID: 132032...

CVE-2017-1575

CVE-2017-1575 affects IBM Sterling File Gateway (IBM Sterling B2B Integrator Standard Edition) 2.2.0–2.2.6. Root cause: use of weaker cryptographic algorithms enabling a local attacker to decrypt highly sensitive information. Impact: information disclosure with local access (C/H). Remediation: ap...

[SECURITY] Fedora 28 Update: libtomcrypt-1.18.2-1.fc28

A comprehensive, modular and portable cryptographic toolkit that provides developers with a vast array of well known published block ciphers, one-way hash functions, chaining modes, pseudo-random number generators, public key cryptography and a plethora of other routines. Designed from the ground...

Security Bulletin: IBM Security SiteProtector System is affected by GSKit vulnerabilities

Summary IBM Security SiteProtector System has addressed the following vulnerabilities in GSKit. Vulnerability Details CVEID: CVE-2018-1428 DESCRIPTION: IBM GSKit uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base Scor...

IBM Tivoli Application Dependency Discovery Manager Information Disclosure Vulnerability

IBM Tivoli Application Dependency Discovery Manager TADDM is a product in a suite of IT service management solutions from IBM USA that provides robust automated application mapping and discovery to help administrators understand the structure, state, configuration and change history of business...

py-cryptography -- tag forgery vulnerability

The Python Cryptographic Authority PyCA project reports: finalizewithtag allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the mintaglength provided to the GCM constructor...