CVE-2024-45838: Cleartext Transmission of Sensitive Information

The goTenna Pro ATAK Plugin does not encrypt callsigns in messages. It is advised to not use sensitive information in callsigns when using this and previous versions of the plugin. Update to current plugin version which uses AES-256 encryption for callsigns in encrypted operation...

CVE-2024-41931: Insertion of Sensitive Information Into Sent Data

The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations...

PT-2024-29644 · Gotenna · Gotenna Pro Atak Plugin

Name of the Vulnerable Software and Affected Versions: goTenna Pro ATAK Plugin affected versions not specified Description: The issue concerns the transmission of the encryption key name in an unencrypted manner when sent over RF through a broadcast message, potentially revealing the location of...

PT-2024-32418 · Gotenna · Gotenna Pro App +2

Name of the Vulnerable Software and Affected Versions: goTenna Pro App affected versions not specified goTenna Pro X affected versions not specified goTenna Pro X2 affected versions not specified Description: The goTenna Pro series uses AES CTR type encryption for short, encrypted messages withou...

PT-2024-27363 · Advantech · Advantech Adam 5550

Name of the Vulnerable Software and Affected Versions: Advantech ADAM-5550 affected versions not specified Description: The issue is related to the use of weak encryption algorithms in the Advantech ADAM-5550, specifically base 64 encoding, which can allow an attacker to disclose user credentials...

PT-2024-32424 · Gotenna · Gotenna Pro App +2

Name of the Vulnerable Software and Affected Versions: goTenna Pro App affected versions not specified goTenna Pro X and Pro X2 affected versions not specified Description: The issue is related to the goTenna Pro App not injecting extra characters into broadcasted frames to obfuscate the length o...

PT-2024-30298 · Gotenna · Gotenna Pro Atak Plugin

Name of the Vulnerable Software and Affected Versions: goTenna Pro ATAK Plugin affected versions not specified Description: The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable t...

PT-2024-32416 · Gotenna · Gotenna Pro App +2

Name of the Vulnerable Software and Affected Versions: goTenna Pro App versions affected versions not specified goTenna Pro X goTenna Pro X2 Description: The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is capture...

PT-2024-29538 · Gotenna · Gotenna Pro Atak Plugin

Name of the Vulnerable Software and Affected Versions: goTenna Pro ATAK Plugin affected versions not specified Description: The issue allows an attacker to inject custom messages with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This can be exploited if t...

PT-2024-31803

Name of the Vulnerable Software and Affected Versions: goTenna Pro ATAK Plugin versions prior to the current version Description: The goTenna Pro ATAK Plugin does not encrypt callsigns in messages, potentially revealing sensitive information about users. It is advised not to use sensitive...

goTenna Pro ATAK Plugin security vulnerability

The goTenna Pro ATAK Plugin is a plugin for goTenna's device that creates networks for off-grid communications and situational awareness. A security vulnerability exists in goTenna Pro ATAK Plugin version 1.9.12 and earlier, which stems from a susceptibility to load length disclosure, where the...

goTenna Pro security vulnerabilities

goTenna Pro is a series of devices from goTenna that can create networks for off-grid communications and situational awareness. A security vulnerability exists in goTenna Pro that stems from the presence of a payload length vulnerability, which allows the length of the payload to be known...

CVE-2024-47128: Insertion of Sensitive Information Into Sent Data

The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations...

CVE-2024-47121: Weak Password Requirements

The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via...

CVE-2023-52950: Missing Encryption of Sensitive Data

Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user credential via unspecified vectors...

CVE-2023-52948: Missing Encryption of Sensitive Data

Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors...

PT-2024-30621 · Gotenna · Gotenna Pro Atak Plugin

Name of the Vulnerable Software and Affected Versions: goTenna Pro ATAK Plugin affected versions not specified Description: The goTenna Pro ATAK Plugin application stores encryption keys along with a static IV on the device, allowing for complete decryption of keys stored on the device. This...

GHSA-48CR-J2CX-MCR8 Apache Answer: Avatar URL leaked user email addresses

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommend...

Apache Answer: Avatar URL leaked user email addresses

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommend...

CVE-2024-40761

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommend...