CVE-2024-41688 Cleartext Storage of Sensitive Information Vulnerability

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the...

CVE-2024-41688

The CVE-2024-41688 entry refers to a cleartext storage vulnerability in the SyroTech SY-GPON-1110-WDONT Router, caused by lack of encryption when storing usernames and passwords in firmware/database. Exploitation requires physical access: an attacker can extract firmware, reverse engineer the bin...

Couchbase Server 安全漏洞

Couchbase Server is a distributed open source NoSQL non-relational database from Couchbase, Inc. in the United States. It supports data query, full-text search and active global replication. A security vulnerability exists in Couchbase Server versions prior to 7.2.5 and versions 7.6.0 through...

CVE-2024-37034

An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value KV service using SCRAM-SHA when remote link encryption is configured for Half-Secure...

SyroTech SY-GPON-1110-WDONT 安全漏洞

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from a lack of encryption when storing usernames and passwords in the router's firmware/database. An attacker can exploit this...

Windows update may present users with a BitLocker recovery screen

Some Windows users may see a BitLocker Recovery screen after applying the Microsoft patch Tuesday updates. BitLocker is a Windows security feature that encrypts entire drives. It prevents someone that has obtained a stolen or lost device from reading the files stored on that drive. Unfortunately,...

jose4j: denial of service via specially crafted JWE

A flaw was found in the jose.4.j jose4j library. The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c PBES2 Count. This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down...

The vulnerability of the SQL engine of the Dell Data Analytics Engine (DDAE) in the Dell Data Lakehouse data storage platform allows a hacker to disclose protected information.

The vulnerability of the SQL engine of the Dell Data Analytics Engine DDAE in the Dell Data Lakehouse data storage platform is related to the lack of data encryption measures. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

SQL injection vulnerability in the electronic document security management system of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-36673)

Yisetong electronic document security management system is an electronic document security protection software, the system utilizes the driver layer transparent encryption technology, through the encryption protection of electronic documents, to prevent internal employees from leaking and externa...

Dell Data Lakehouse Encryption Issues Vulnerabilities

Dell Data Lakehouse is a fully integrated data platform from Dell, Inc. An encryption issue vulnerability exists in Dell Data Lakehouse version 1.0.0.0, which stems from a missing encryption of sensitive data contained in the DDAE. An attacker could exploit this vulnerability to cause information...

Siemens SIMATIC and SCALANCE Products Inadequate Encryption Strength (CVE-2023-0465)

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that...

Siemens SIMATIC and SCALANCE Products Inadequate Encryption Strength (CVE-2023-0464)

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of...

ALSA-2024:4762 Important: runc security update

The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads CVE-2024-1394 For more details about the security issues, including the impact...

The vulnerability of the TLS/SSL software component used for managing SAN networks in Brocade SANnav systems allows attackers to execute a type of “man-in-the-middle” attack.

The vulnerability of the TLS/SSL software components used for managing SAN networks in Brodage SANnav systems is related to insufficient encryption reliability. Exploiting this vulnerability could allow a remote attacker to carry out a “man-in-the-middle” attack and gain unauthorized access to...

Siemens SIMATIC and SCALANCE Products Inadequate Encryption Strength (CVE-2023-0466)

The function X509VERIFYPARAMadd0policy is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate...

RHEL 9 : runc (RHSA-2024:4762)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4762 advisory. The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes:...

Siemens SIMATIC and SCALANCE Products Inadequate Encryption Strength (CVE-2022-2097)

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of 'in place' encryption...

Hikvision IP Cameras Missing Encryption of Sensitive Data (CVE-2017-14953)

HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrary access point by leveraging a default SSID with no WiFi encryption or authentication. NOTE: Vendor states that this is not a vulnerability, but more an...

GHSA-6PFF-FMH2-4MMF Apache CXF Denial of Service vulnerability in JOSE

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token...

Important: Red Hat Security Advisory: qt5-qtbase security update

An update for qt5-qtbase is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...