The vulnerability of the SSL-VPN portal for FortiOS operating systems allows a hacker to obtain the encryption key.

The vulnerability of the SSL-VPN portal for FortiOS operating systems is related to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability could allow a malicious actor to obtain the encryption key remotely...

Security Bulletin: IBM Watson Knowledge Catalog (with Information Server) is affected by a Cryptographic vulnerability

Summary A Cryptographic vulnerability was addressed by IBM Watson Knowledge Catalog with Information Server. Vulnerability Details CVEID: CVE-2019-4220 DESCRIPTION: IBM InfoSphere Information Server stores a common hard coded encryption key that could be used to decrypt sensitive information. CVS...

Default credentials

RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were used...

CVE-2022-26660

RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were used...

CVE-2022-26660

CVE-2022-26660 affects RunAsSpc 4.0. The root cause is a universal and recoverable encryption key used to protect credentials, enabling the recovery of credentials from a file encrypted by RunAsSpc. Impact stated: an attacker who gains access to an encrypted RunAsSpc file can recover the credenti...

CVE-2022-26660: Use of Hard-coded Credentials

RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were used...

PT-2022-17992

Name of the Vulnerable Software and Affected Versions RunAsSpc version 4.0 Description The issue concerns the use of a universal and recoverable encryption key in RunAsSpc. If an attacker gains possession of a file encrypted by RunAsSpc, they can recover the credentials that were used...

Authentication flaw

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...

CVE-2021-38296: Authentication Bypass by Capture-replay

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...

Authentication flaw

Fresenius Kabi Vigilant Software Suite Mastermed Dashboard version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitrary users...

CVE-2021-33846 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm

Fresenius Kabi Vigilant Software Suite Mastermed Dashboard version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitrary users...

CVE-2021-33846

CVE-2021-33846 affects Fresenius Kabi Vigilant Software Suite MasterMed Dashboard (v2.0.1.3). The vulnerability arises because authentication tokens issued to authenticated users are signed with a symmetric encryption key, enabling an attacker possessing the key to issue valid JWTs and impersonat...

PT-2022-10293

Name of the Vulnerable Software and Affected Versions Fresenius Kabi Vigilant Software Suite Mastermed Dashboard version 2.0.1.3 Description The issue allows an attacker in possession of a symmetric encryption key to issue valid JWTs and impersonate arbitrary users, as the authentication tokens...

CVE-2021-33846: Use of a Broken or Risky Cryptographic Algorithm

Fresenius Kabi Vigilant Software Suite Mastermed Dashboard version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitrary users...

Dell PowerPath Management Appliance安全漏洞

The DELL Dell PowerPath Management Appliance is a PowerPath host management application from Dell USA that offers two models: a virtual machine-based appliance and a Docker containerized appliance. A security vulnerability exists in the Dell PowerPath Management Appliance, which can be exploited ...

The vulnerability of the “Remember Me” function implementation in the Apache Shiro framework allows a hacker to execute arbitrary code or bypass security restrictions.

The vulnerability of the “Remember Me” function implementation in the Apache Shiro framework is related to the use of the default encryption key. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or bypass security restrictions remotely...

Dell EMC CloudLink 安全漏洞

Dell EMC CloudLink is a flexible data encryption and key management solution for data encryption in public, private, and hybrid cloud environments.Dell EMC CloudLink 7.1 and earlier versions contain an arbitrary file creation vulnerability that can be exploited by remote unauthenticated attackers...

Information disclosure

An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtain the encryption key used to decrypt firmware update packages...

CVE-2021-3789

An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtain the encryption key used to decrypt firmware update packages...

CVE-2021-3789

CVE-2021-3789 affects some Motorola‑branded Binatone Hubble Cameras. The root cause is an information disclosure that could allow a physically proximate attacker to obtain the encryption key used to decrypt firmware update packages. The vulnerability enables access to confidential keys, enabling ...