5554 matches found
Node.js: Multiple OpenSSL error handling issues in nodejs crypto library
Multiple OpenSSL error handling issues were discovered in the Node.js crypto library up to version 19.2.0. The library did not clear the OpenSSL error stack after operations that may set it, which could lead to false positive errors during subsequent cryptographic operations that happen to be on...
CVE-2022-46832
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version 2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmwa...
PT-2022-27990 · Sick · Sick Rfu62X
Name of the Vulnerable Software and Affected Versions: SICK RFU62x firmware versions prior to 2.21 Description: The issue is related to the use of a broken or risky cryptographic algorithm, allowing a low-privileged remote attacker to decrypt encrypted data if weak cipher suites are used for...
CVE-2022-4261: Rapid7 Nexpose Update Validation Issue (FIXED)
On November 14, 2022, Rapid7's product engineering team discovered that the mechanism in Nexpose and InsightVM used to validate the source of an update file was unreliable. This failure, which involved the internal cryptographic validation of received updates, was designated as CVE-2022-4261, and...
Amazon Linux AMI : golang (ALAS-2022-1635)
The version of golang installed on the remote host is prior to 1.18.6-1.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1635 advisory. 2023-11-29: CVE-2021-39293 was added to this advisory. 2023-11-29: CVE-2022-23806 was added to this advisory. 2023-11-29...
CVE-2022-34361
IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 230522...
PT-2022-22145 · Ibm · Ibm Sterling Secure Proxy
Name of the Vulnerable Software and Affected Versions: IBM Sterling Secure Proxy version 6.0.3 Description: The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations: For IBM Sterling...
Upgraded Q -> M from #373 [1670018401792]
Judge has assessed an item in Issue 373 as M risk. The relevant finding follows: N2. ETH not accumulated in previewAccumulatedETH supposed to have accumulated += ... Although it is an external view function, depending on its usages, it may present more issues to the callers. --- The text was...
3 New Vulnerabilities Affect OT Products from German Companies Festo and CODESYS
Researchers have disclosed details of three new security vulnerabilities affecting operational technology OT products from CODESYS and Festo that could lead to source code tampering and denial-of-service DoS. The vulnerabilities, reported by Forescout Vedere Labs, are the latest in a long list of...
SUSE SLED15: python2-cryptography / python2-cryptography-vectors / etc (SUSE-SU-2022:4044-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4044-1 advisory. - Update in SLE-15 bsc1177083, jscPM-2730, jscSLE-18312 - Refresh patches for new version - Update in...
SUSE-SU-2022:4044-1 Security update for python-cryptography, python-cryptography-vectors
This update for python-cryptography, python-cryptography-vectors fixes the following issues: - Update in SLE-15 bsc1177083, jscPM-2730, jscSLE-18312 - Refresh patches for new version - Update in SLE-15 bsc1176785, jscECO-3105, jscPM-2352 - update to 2.9.2 2.9.2 - 2020-04-22 - Updated the macOS...
SUSE: Security Advisory (SUSE-SU-2022:4044-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
golang: crypto/tls: certificate of wrong type is causing TLS client to panic
A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists or can be issued, or the client is configured with...
python-cryptography bug fix and enhancement update
An update is available for python-cryptography. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rock...
CVE-2022-34320
IBM CICS TX 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229464...
GSD-2022-1007396 crypto: akcipher - default implementation for setting a private key
crypto: akcipher - default implementation for setting a private key This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.220 by commit...
CVE-2022-34320 IBM CICS TX information disclosure
IBM CICS TX 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229464...
CVE-2022-34319 IBM CICS TX information disclosure
IBM CICS TX 11.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229463...
PT-2022-35508 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v3.17 through v5.10.149 Description: The issue concerns a fix for DMA transfer direction in the crypto: qat module. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...