CVE-2024-50684

SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data insufficient entropy. This may allow attackers to decrypt intercepted communications between the mobile app and iSolarCloud...

Android happy to check your nudes before you forward them

Sometimes the updates we install to keep our devices safe do a little bit more than we might suspect at first glance. Take the October 2024 Android Security Bulletin. It included a new service called Android System SafetyCore. If you can find a mention of that in the security bulletin, you’re a...

Signal Threatens to Exit Sweden Over Government’s Backdoor Proposal

Sweden’s proposal to mandate encryption backdoors faces backlash from Signal, cybersecurity experts, and even its military over privacy and security risks...

DEBIAN-CVE-2022-49262

In the Linux kernel, the following vulnerability has been resolved: crypto: octeontx2 - remove CONFIGDMCRYPT check No issues were found while using the driver with dm-crypt enabled. So CONFIGDMCRYPT check in the driver can be removed. This also fixes the NULL pointer dereference in driver release...

UBUNTU-CVE-2022-49262

In the Linux kernel, the following vulnerability has been resolved: crypto: octeontx2 - remove CONFIGDMCRYPT check No issues were found while using the driver with dm-crypt enabled. So CONFIGDMCRYPT check in the driver can be removed. This also fixes the NULL pointer dereference in driver release...

UBUNTU-CVE-2022-49260

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec - fix the aead software fallback for engine Due to the subreq pointer misuse the private context memory. The aead soft crypto occasionally casues the OS panic as setting the 64K page. Here is fix it...

SUSE CVE-2025-27144

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

CVE-2025-0760

A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption...

CVE-2024-50684

The SunGrow iSolarCloud Android app (version V2.1.6.20241017 and prior) is vulnerable to a security flaw involving the use of an insecure AES key with insufficient entropy to encrypt client data. This vulnerability may allow an attacker to decrypt intercepted communications between the mobile app...

CVE-2024-52925

In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives...

CVE-2024-52925

In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives...

SunGrow iSolarCloud security vulnerabilities

SunGrow iSolarCloud is an Android app for new energy power plant management from China SunGrow SunGrow. It is used for power plant data collection, monitoring, operation and maintenance and operation management. A security vulnerability exists in the SunGrow iSolarCloud Android app version...

CVE-2024-50684

SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data insufficient entropy. This may allow attackers to decrypt intercepted communications between the mobile app and iSolarCloud...

CVE-2025-0760 Stored Credential Disclosure Vulnerability

A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption...

CVE-2025-0760 Stored Credential Disclosure Vulnerability

A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption...

CVE-2025-0760

CVE-2025-0760 describes a credential disclosure in Tenable Identity Exposure prior to version 3.77.9. The root cause is lack of encryption for stored SMTP credentials, allowing an administrator to extract them. The CVSS v3.1 base metrics indicate a Low impact (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)...

USN-7297-1 ProFTPD vulnerabilities

Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that the transport protocol implementation in ProFTPD had weak integrity checks. An attacker could use this vulnerability to bypass security features like encryption and integrity checks. CVE-2023-48795 Martin Mirchev discovered that...

Siemens SIMATIC S7-1500 TM MFP BIOS Missing Encryption of Sensitive Data (CVE-2023-0394)

A NULL pointer dereference flaw was found in rawv6pushpendingframes in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Siemens SIMATIC S7-1500 TM MFP BIOS Missing Encryption of Sensitive Data (CVE-2022-21233)

Improper isolation of shared resources in some IntelR Processors may allow a privileged user to potentially enable information disclosure via local access. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...

Tenable Identity Exposure security vulnerability

Tenable Identity Exposure is a fast, agentless solution from Tenable, Inc. It can detect and block attacks, eliminate attack paths, and provide risk-based guidance on vulnerability management and remediation. A security vulnerability exists in Tenable Identity Exposure versions prior to 3.77.9,...