250 matches found
CLSA-2024-1730910767 Update of ca-certificates
update to CKBI 2.69 from NSS 3.103 - updated certificates: - Certificate "GLOBALTRUST 2020" - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Baltimore CyberTrust Root" - Certificate "Entrust Root...
CVE-2024-39342
Entrust Instant Financial Issuance formerly known as Cardwizard 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library i.e. DCG.Security.dll with a custom AES encryption process that relies on static hard-coded key values. These keys are not uniquely generated per installation of t...
CVE-2024-39341
Entrust Instant Financial Issuance On Premise Software formerly known as Cardwizard 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier leaves behind a configuration file i.e. WebAPI.cfg.xml after the installation process. This file can be accessed without authentication on HTTP port 80 by guessin...
CVE-2024-39342: Improper Privilege Management
Entrust Instant Financial Issuance formerly known as Cardwizard 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library i.e. DCG.Security.dll with a custom AES encryption process that relies on static hard-coded key values. These keys are not uniquely generated per installation of t...
CVE-2024-39341
Entrust Instant Financial Issuance On Premise Software formerly known as Cardwizard 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier leaves behind a configuration file i.e. WebAPI.cfg.xml after the installation process. This file can be accessed without authentication on HTTP port 80 by guessin...
CVE-2024-39342
Entrust Instant Financial Issuance formerly known as Cardwizard 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library i.e. DCG.Security.dll with a custom AES encryption process that relies on static hard-coded key values. These keys are not uniquely generated per installation of t...
CVE-2024-39341
Entrust Instant Financial Issuance On Premise Software formerly known as Cardwizard 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier leaves behind a configuration file i.e. WebAPI.cfg.xml after the installation process. This file can be accessed without authentication on HTTP port 80 by guessin...
CVE-2024-39342
Entrust Instant Financial Issuance (formerly Cardwizard) versions 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier are vulnerable to privilege escalation on Windows hosts. The flaw exists in the DCG.Security.dll library, which utilizes a custom AES encryption process relying on static hard-code...
CVE-2024-39341
Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) versions 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier are vulnerable to unauthorized information disclosure. The software leaves behind a configuration file, WebAPI.cfg.xml , after installation. This fil...
CVE-2024-39341: Authentication Bypass by Spoofing
Entrust Instant Financial Issuance On Premise Software formerly known as Cardwizard 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier leaves behind a configuration file i.e. WebAPI.cfg.xml after the installation process. This file can be accessed without authentication on HTTP port 80 by guessin...
CVE-2024-39342
Entrust Instant Financial Issuance formerly known as Cardwizard 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library i.e. DCG.Security.dll with a custom AES encryption process that relies on static hard-coded key values. These keys are not uniquely generated per installation of t...
CVE-2024-34329
Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated attackers to execute arbitrary code as SYSTEM via a crafted DLL payload...
PT-2024-25789 · Entrust Datacard · Entrust Datacard Xps Card Printer Driver
Name of the Vulnerable Software and Affected Versions: Entrust Datacard XPS Card Printer Driver versions 8.5 and earlier without the dxp1-patch-E24-004 patch Entrust Datacard XPS Card Printer Driver versions 8.4 and earlier Description: The issue is related to insecure permissions in the Entrust...
CVE-2024-34329
Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated attackers to execute arbitrary code as SYSTEM via a crafted DLL payload...
CVE-2024-34329: Insecure Inherited Permissions
Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated attackers to execute arbitrary code as SYSTEM via a crafted DLL payload...
CVE-2024-34329
The Entrust Datacard XPS Card Printer Driver (versions 8.5 and earlier, or 8.4 and earlier) is vulnerable to a Local Privilege Escalation (LPE) due to insecure file and folder permissions. Specifically, the directory C:\ProgramData\Datacard\XPS Card Printer\Service grants full control to all user...
CVE-2024-34329
Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated attackers to execute arbitrary code as SYSTEM via a crafted DLL payload...
How to Detect Issuer Certificates and Comply with Google Chrome’s New Entrust Certificate Policy Using Qualys Certificate View
Google has announced that Chrome 127 and higher will no longer trust certain TLS certificates issued by Entrust, effective November 1, 2024. This change is significant and could potentially disrupt businesses relying on Entrust-issued certificates. Google stated that "publicly disclosed incident...
Google to Block Entrust Certificates in Chrome Starting November 2024
Google has announced that it's going to start blocking websites that use certificates from Entrust starting around November 1, 2024, in its Chrome browser, citing compliance failures and the certificate authority's inability to address security issues in a timely manner. "Over the past several...
