travels-java-api 安全漏洞

travels-java-api is an API for travel management from the individual developer Mariana Azevedo. A security vulnerability exists in travels-java-api version 5.0.1 and earlier, which stems from the use of hard-coded encryption keys in the doFilterInternal function in the JWT Secret Handler componen...

kernel: cifs: fix oops during encryption

An out-of-bounds memory access vulnerability exists in the linux kernel, such that A stack-allocated buffer backed by vmalloc was passed into crypto code scatterwalkmapandcopy → memcpy where a cross-page write occurred. This ended up hitting a read-only mapping, causing a page-level fault and...

nimbus-jose-jwt: large JWE p2c header value causes Denial of Service

A vulnerability was found in the Nimbus Jose JWT package. By crafting a JWE with an excessively large p2c value, an attacker can trigger significant resource consumption during decryption, potentially leading to application slowdown or unavailability...

CVE-2024-51556

This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensiti...

CVE-2024-51556

This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensiti...

CGA-WXGC-VWF3-9PRP

Bulletin has no description...

CVE-2024-51556 Sensitive Information Disclosure Vulnerability in Wave 2.0

This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensiti...

CVE-2024-51556

The CVE-2024-51556 entry concerns Wave 2.0 with an issue where sensitive data is insufficiently encrypted in API responses. The vulnerability enables an authenticated remote attacker to manipulate API input parameters via the request URL/payload, potentially leading to unauthorized access to othe...

CVE-2024-38408

CVE-2024-38408 describes a cryptographic issue in Qualcomm Bluetooth controller code triggered when an LMP Start Encryption command is received under unexpected conditions. Affected are Qualcomm chipset families with closed-source components; the vulnerability is rated Critical by NVD (CVE-2024-3...

Important: Red Hat Security Advisory: krb5 security update

An update for krb5 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that stems from an encryption issue that occurs when the controller receives an LMP Initiate Encryption command under unexpected circumstances...

Brokerage Wave 加密问题漏洞

Brokerage Wave is a frontend product from Brokerage, Inc. An encryption issue vulnerability exists in Brokerage Wave version 2.0, which stems from weak encryption of sensitive data received at the API response, which could allow an attacker to manipulate the parameter userid via the API request U...

PT-2024-34699 · Wave · Wave

Name of the Vulnerable Software and Affected Versions: Wave version 2.0 Description: The issue arises from insufficient encryption of sensitive data received at the API response, allowing an authenticated remote attacker to exploit it by manipulating API input parameters. This could lead to...

RHEL 5 / 6 : JBoss Enterprise Web Platform 5.2.0 (RHSA-2013:0874)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0874 advisory. The Enterprise Web Platform is a slimmed down profile of the JBoss Enterprise Application Platform intended for mid-size workloads with light and...

SUSE CVE-2024-33662

Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function...

Important: qt5-qtconnectivity

Issue Overview: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted signal has not ye...

Amazon Linux 2 : qt5-qtlocation (ALAS-2024-2670)

The version of qt5-qtlocation installed on the remote host is prior to 5.15.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2670 advisory. An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x throu...

Important: qt5-qtdeclarative

Issue Overview: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted signal has not ye...

Important: qt5-qtlocation

Issue Overview: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted signal has not ye...

The vulnerability of DrayTek Vigor router microprogramming software, related to insufficiently secure data encryption, allows attackers to disclose protected information and perform a “Man-in-the-Middle” attack.

The vulnerability of DrayTek Vigor router microprogramming software is related to insufficiently robust data encryption. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose protected information and carry out a Middleware Incident Response Team MITM attack...