PT-2024-27204

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description The issue arises in CoCo VMs where an untrusted host can cause set memory encrypted or set memory decrypted to fail, leading to shared memory. Callers must handle these errors to prevent...

PT-2024-27203

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In CoCo VMs, it is possible for the untrusted host to cause set memory encrypted or set memory decrypted to fail, resulting in shared memory. Callers need to handle these errors to avoid...

CVE-2023-7046 WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score <= 7.0 - Sensitive Information Exposure via insufficiently protected files

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0 via exposed Private key files. This makes it possible for unauthenticated attackers to...

CVE-2023-7046 WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score <= 7.0 - Sensitive Information Exposure via insufficiently protected files

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0 via exposed Private key files. This makes it possible for unauthenticated attackers to...

CVE-2023-7046

CVE-2023-7046 affects the WordPress plugin “WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, Security+” by Wordfence: root cause is exposure of private key files, enabling unauthenticated attackers to obtain TLS private keys (Sensitive Information Exposure). I...

CL0P's Ransomware Rampage - Security Measures for 2024

2023 CL0P Growth Emerging in early 2019, CL0P was first introduced as a more advanced version of its predecessor the 'CryptoMix' ransomware, brought about by its owner CL0P ransomware, a cybercrime organisation. Over the years the group remained active with significant campaigns throughout 2020 t...

WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score < 7.1.0 - Sensitive Information Exposure via insufficiently protected files

Description The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0 via exposed Private key files. This makes it possible for unauthenticated...

WordPress Plugin WP Encryption 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-3318 · WordPress · Wp Encryption

Name of the Vulnerable Software and Affected Versions: WP Encryption plugin for WordPress versions up to, and including, 7.0 Description: The issue is related to insufficient protection of internal data, which can be exploited by a remote attacker to disclose protected information. Specifically,...

PT-2024-23576 · Unknown · Ros2 Galactic Geochelone

Name of the Vulnerable Software and Affected Versions: ROS2 Galactic Geochelone versions 2 Description: An issue was discovered where the system transmits messages in plaintext, allowing attackers to access sensitive information via a man-in-the-middle attack. Recommendations: For ROS2 Galactic...

CVE-2024-24279

An issue in secdiskapp 1.5.1 management program for NewQ Fingerprint Encryption Super Speed Flash Disk allows attackers to gain escalated privileges via vsVerifyPassword and vsSetFingerPrintPower functions...

nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)

A flaw was found in Node.js. The privateDecrypt API of the crypto library may allow a covert timing side-channel during PKCS1 v1.5 padding error handling. This issue revealed significant timing differences in decryption for valid and invalid ciphertexts, which may allow a remote attacker to decry...

nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)

A flaw was found in Node.js. The privateDecrypt API of the crypto library may allow a covert timing side-channel during PKCS1 v1.5 padding error handling. This issue revealed significant timing differences in decryption for valid and invalid ciphertexts, which may allow a remote attacker to decry...

PT-2024-23560 · Unknown · Ros2 Iron Irwini

Name of the Vulnerable Software and Affected Versions: ROS2 Iron Irwini versions 2 Description: An issue has been discovered where the system transmits messages in plaintext, exposing sensitive information and making it vulnerable to man-in-the-middle MitM attacks. This allows attackers to...

CVE-2024-24279

CVE-2024-24279 affects secdiskapp 1.5.1 (management program for the NewQ Fingerprint Encryption Super Speed Flash Disk). The issue allows attackers to escalate privileges via the vsVerifyPassword and vsSetFingerPrintPower functions. Reports from multiple sources (NVD, Red Hat, CNNVD, CVE listing,...

IBM WebSphere Application Server Encryption Problem Vulnerability (CNVD-2024-20496)

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. An encryption issue vulnerability exists in IBM WebSpher...

PT-2024-23550 · Unknown · Ros Melodic Morenia

Name of the Vulnerable Software and Affected Versions: ROS Robot Operating System Melodic Morenia versions 1 Description: An issue was discovered where the system transmits messages in plaintext, exposing sensitive information and making it vulnerable to man-in-the-middle MitM attacks. This allow...

CVE-2024-28065

In Unify CP IP Phone firmware 1.10.4.3, files are not encrypted and contain sensitive information such as the root password hash...

RLSA-2024:1646 Important: grafana security and bug fix update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads CVE-2024-1394 Bug Fixes: TRIAGE CVE-2024-1394 grafana: golang-fips/openssl: Memory leaks i...

CVE-2024-28065

CVE-2024-28065 affects Unify CP IP Phone firmware 1.10.4.3. The issue arises because files are not encrypted and contain sensitive data such as the root password hash. CVSS 3.1 vector: AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N, base score 5.9 (Medium). Exploitation status is not provided in the documen...