26763 matches found
WordPress Abandoned Cart Lite for WooCommerce Plugin < 5.15.2 Authentication Bypass Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tychesoftwares:abandonedcartliteforwoocommerce"; if...
[SECURITY] Fedora 39 Update: openvpn-2.6.8-1.fc39
OpenVPN is a robust and highly flexible tunneling application that uses all of the encryption, authentication, and certification features of the OpenSSL library to securely tunnel IP networks over a single UDP or TCP port. It can use the Marcus Franz Xaver Johannes Oberhumers LZO library for...
Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication
Impact secretKey, an important key for HMAC SHA256 authentication, was stored in the database in raw form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that person. Patches...
GHSA-V427-C49J-8W6X Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication
Impact secretKey, an important key for HMAC SHA256 authentication, was stored in the database in raw form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that person. Patches...
PT-2023-7270 · Rvtools · Rvtools
Name of the Vulnerable Software and Affected Versions: RVTools versions 3.9.2 and above Description: The issue is related to errors in cryptographic transformations, which can allow a remote attacker to gain unauthorized access to protected information. Specifically, the vulnerability in the...
CVE-2023-6253
A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller key from the memory of the uninstaller file...
CVE-2023-6253
A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller key from the memory of the uninstaller file...
Design/Logic Flaw
A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller key from the memory of the uninstaller file...
Plaintext exposed in decrypt_in_place_detached even on tag verification failure
Summary In the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails. Impact If a program using the aes-gcm crate's decryptinplace APIs accesses the buffer after decryption failure, it will contain a...
CVE-2023-6253
CVE-2023-6253 affects Digital Guardian Agent prior to version 7.9.4, where an encryption/uninstall key is stored in the uninstaller. A local attacker can retrieve the uninstall key from memory of the uninstaller file and use it to remove the software. Affected component: Agent Uninstaller; root c...
CVE-2023-6253 Saved Uninstall Key in Digital Guardian Agent Uninstaller
A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller key from the memory of the uninstaller file...
The vulnerability of the software for automated, cloud-based, and on-premise administration of IBM Security Verify Privilege accounts lies in the lack of data encryption measures. This allows attackers to carry out “man-in-the-middle” attacks.
The vulnerability of the software for automated, cloud-based, and on-premise administration of IBM Security Verify Privilege accounts is related to the lack of data encryption measures. Exploiting this vulnerability could allow a malicious actor to carry out “man-in-the-middle” attacks...
Nothing Chats pulled from Google Play
Sometimes it’s all in the name. The Nothing Chats beta has been pulled from the Google Play Store after reports that the company behind it has access to your unencrypted messages. Nothing Phone 2 owners were promised a first-of-its-kind app developed in partnership with Sunbird, which allowed the...
Why less is more: 10 steps to secure customer data
In an advisory aimed at the protection of customers’ personal data, the Australian Cyber Security Centre ACSC has emphasized that businesses should only collect personal data from customers that they need in order to operate effectively. While that may seem like kicking in an open door, it’s real...
Weak Encryption
upydev is vulnerable to Weak Encryption. The vulnerability is due to PKCS 1v1.5 padding used in the RSA algorithm. This could lead to a Bleichenbacher attack...
upydev has weak encryption padding
An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding...
GHSA-QC4J-HRJ6-CPPF upydev has weak encryption padding
An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding...
IBM CICS TX Advanced Weak Algorithm Vulnerability
IBM CICS TX is a comprehensive, single transaction runtime package from International Business Machines IBM. A weak algorithmic vulnerability exists in IBM CICS TX Advanced version 10.1, which stems from the use of a weak encryption algorithm that can be exploited by an attacker to decrypt highly...
