The vulnerability of the repository for Trusted Platform Module tpm2-tools, related to the disclosure of information, allows a perpetrator to gain access to confidential data.

The vulnerability of the repository for Trusted Platform Module tpm2-tools is related to the use of a fixed AES key for internal encryption. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to confidential data...

CVE-2021-41829

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key...

CVE-2021-41829

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key...

Code injection

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key...

CVE-2021-41829

CVE-2021-41829 affects Zoho ManageEngine Remote Access Plus prior to 10.1.2121.1, where an encryption key is derived from the application’s build number. The Red Hat and NVD entries corroborate the same description. No exploit details are provided in the connected documents. Mitigation is to upgr...

Cachet 2.4: Code Execution via Laravel Configuration Injection

Status pages are now an essential service offered by all Software-as-a-Service companies we do it too!. To help their adoption, startups quickly conceived status pages as-a-service, and open-source self-hosted alternatives were made available. Cachet, also sometimes referred to as CachetHQ, is a...

Enbra Ewm Trust Management Issue Vulnerability

Enbra Ewm is a universal reading device from the Czech company Enbra. It uses radios to read water meters, heating cost indicators and heat meters. Enbra EWM is vulnerable to a trust management issue, which stems from multiple wireless M-Bus devices from Enbra using hard-coded credentials in secu...

CVE-2021-34571

Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adversary can learn all information that is available in Enbra EWM...

Hardcoded credentials

Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adversary can learn all information that is available in Enbra EWM...

CVE-2021-34571

The CVE-2021-34571 entry concerns Enbra EWM, a universal Enbra Wireless M-Bus reading device. Concrete details across connected records show a trust/credential management issue in which several wireless M-Bus devices use hard-coded credentials in secure mode 5, with no option to change the encryp...

CVE-2021-34571 Hard-coded Credentials in Enbra Wireless M-Bus devices

Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adversary can learn all information that is available in Enbra EWM...

WhatsApp to Finally Let Users Encrypt Their Chat Backups in the Cloud

WhatsApp on Friday announced it will roll out support for end-to-end encrypted chat backups on the cloud for Android and iOS users, paving the way for storing information such as chat messages and photos in Apple iCloud or Google Drive in a cryptographically secure manner. The optional feature,...

CyberArk Credential File Insufficient Effective Key Space

Vulnerability Details Affected Vendor: CyberArk Affected Product: Application Access Manager/Credential Provider Affected Version: Prior to 12.1 Platform: Linux/Windows/zOS CWE Classification: CWE-326: Inadequate Encryption Strength CVE ID: CVE-2021-31796 2. Vulnerability Description CyberArk...

The vulnerability of the microprogrammed logic controllers from Schneider Electric, such as Modicon M221, M100, and M200, stems from insufficiently secure data encryption. This allows attackers to obtain the encryption key.

The vulnerability of the microprogrammed logic controllers from Schneider Electric, such as Modicon M221, M100, and M200, is related to insufficiently secure data encryption. Exploiting this vulnerability could allow a malicious actor to obtain the encryption key remotely...

CVE-2021-38461

The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Code injection

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-20505

The PowerVM Logical Partition MobilityLPM PowerVM Hypervisor FW920, FW930, FW940, and FW950 encryption key exchange protocol can be compromised. If an attacker has the ability to capture encrypted LPM network traffic and is able to gain service access to the FSP they can use this information to...

CVE-2021-20505

The CVE-2021-20505 entry concerns IBM PowerVM Logical Partition Mobility (LPM) encryption key exchange protocol weaknesses. According to NVD/NVD-derived data, if an attacker can capture encrypted LPM traffic and gains service access to the Flexible Service Processor (FSP), they can perform PowerV...