CVE-2017-13097

CVE-2017-13097 refers to a weakness in the IEEE P1735 standard where an attacker can modify the Rights Block to remove or relax license requirements. The associated CERT/NVD entries describe this as part of a broader set of flaws in P1735 that can enable recovery of plaintext IP and insertion of ...

CVE-2017-13091

CVE-2017-13091 concerns the IEEE P1735 standard’s handling of encryption for electronic-design IP. The issue arises from improperly specified padding in CBC mode, which can enable an EDA tool to function as a decryption oracle and, in the worst cases, allow recovery of the entire underlying plain...

CVE-2017-13093 The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of encrypted IP cyphertext to insert hardware trojans

The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property IP, as well as the management of access rights for such IP, including modification of encrypted IP cyphertext to insert hardware trojans. The methods are flawed and, in the most egregious cases...

CVE-2017-13093

The CVE-2017-13093 entry documents a vulnerability in the IEEE P1735 cryptographic workflow where an attacker can modify encrypted IP ciphertext to insert hardware Trojans. Affected scope comes from the P1735 standard used in EDA tools and IP workflows, enabling potential IP theft or compromised ...

SSE-C Cryptographic Flaw

github.com/minio/minio is vulnerable to cryptographic flaws. The vulnerability exists as there is a weakness in the derived key-encryption-key for SSE-C encrypted objects. The vulnerability allows malicious users to replace objects that are encrypted with the same client key as it was not bound t...

[SECURITY] Fedora 28 Update: botan2-2.7.0-1.fc28

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

Security Bulletin: IBM® Db2® is affected by multiple vulnerabilities in the GSKit library

Summary Db2 is affected by multiple vulnerabilities in the GSKit library. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive information, caused by a side-channel attack against a system based on the Intel Sandy-Bridge microarchitectur...

Hardcoded credentials

Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network based attackers to gain unauthorized access to services...

CVE-2018-0040

Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network based attackers to gain unauthorized access to services...

CVE-2018-0040 Contrail Service Orchestration: hardcoded cryptographic certificates and keys

Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network based attackers to gain unauthorized access to services...

CVE-2017-3198

GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker can make arbitrary modifications to firmware images without being detected...

Debian DLA-1418-1 : bouncycastle security update

Several security vulnerabilities were found in Bouncy Castle, a Java implementation of cryptographic algorithms. CVE-2016-1000338 DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have...

Debian: Security Advisory (DLA-1398-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1418-1] bouncycastle security update

Package : bouncycastle Version : 1.49+dfsg-3+deb8u3 CVE ID : CVE-2016-1000338 CVE-2016-1000339 CVE-2016-1000341 CVE-2016-1000342 CVE-2016-1000343 CVE-2016-1000345 CVE-2016-1000346 Several security vulnerabilities were found in Bouncy Castle, a Java implementation of cryptographic algorithms...

Authentication flaw

Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to bypass authentication...

CVE-2018-11635

Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to bypass authentication...

CVE-2018-11635

Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to bypass authentication...

Security Bulletin: Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products

Summary Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products. Vulnerability Details CVEID: CVE-2018-1447 DESCRIPTION: The GSKit CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak...

EulerOS 2.0 SP3 : ruby (EulerOS-SA-2018-1207)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create...

Key Considerations in API security

Every day, there are billions of API calls being executed. These include public APIs, private APIs, SaaS APIs, APIs performing mobile back-end functions and many more. Given the gravity of the threat and the sheer volume of what’s exposed, how do we develop systems that are both safe and robust?...