Fortinet FortiMail 安全特征问题漏洞

Fortinet FortiMail is a set of e-mail security gateway products of the U.S. Fita Fortinet. The product provides email security and data protection features. A security signature vulnerability exists in Fortinet FortiMail, which stems from the use of a weak pseudo-random number generator in the...

Sharperner - Simple Executable Generator With Encrypted Shellcode

Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning. Features PE binary Process Hollowing PPID Spoofing Random generated AES key and iv...

shadowbroker

This repository contains a collection of exploits and tools, including the "EARLYSHOVEL" exploit for RedHat 7.0-7.1 Sendmail 8.11.x, the "EBBISLAND EBBSHAVE" exploit for Solaris 6, 7, 8, 9 & 10, and the "ECHOWRECKER" exploit for remote Samba 3.0.x Linux. The repository also includes a payload...

PT-2021-3854 · Fortinet · Fortimail

Name of the Vulnerable Software and Affected Versions: FortiMail affected versions not specified Description: The issue is related to errors in the code of the pseudorandom number generator in the FortiMail IBE Identity Based Encryption service. This could allow a remote attacker to gain...

Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limi...

CVE-2021-0131

Use of cryptographically weak pseudo-random number generator PRNG in an API for the IntelR Security Library before version 3.3 may allow an authenticated user to potentially enable information disclosure via network access...

SUSE: Security Advisory (SUSE-SU-2019:0197-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Adventures in Contacting the Russian FSB

KrebsOnSecurity recently had occasion to contact the Russian Federal Security Service FSB, the Russian equivalent of the U.S. Federal Bureau of Investigation FBI. In the process of doing so, I encountered a small snag: The FSBs website said in order to communicate with them securely, I needed to...

wolfssl

This repository is an implementation of the wolfSSL library, a cryptographic library for secure communication. The library is designed to be used with various platforms, including Arduino, and provides a range of cryptographic functions for secure data transmission. The repository contains a...

CVE-2020-26556

A flaw was found in the Linux kernel’s authentication protocol in the Bluetooth® Mesh Profile Specification. A vulnerability occurs if the AuthValue is identified during the provisioning procedure, even if the AuthValue is selected randomly. This flaw allows an attacker to identify the AuthValue...

CVE-2021-32629

Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape i...

PYSEC-2021-87

Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape i...

CVE-2021-32629

Cranelift’s x64 backend bug in 0.73 (and certain earlier builds when the new backend is explicitly selected) can sign-extend a loaded i32 value, potentially enabling sandbox escapes in Wasm modules and exposing memory up to 2 GiB before the heap. Wasmtime and Lucet using Cranelift may be exploita...

CVE-2021-32629 Memory access due to code generation flaw in Cranelift module

Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape i...

Design/Logic Flaw

It was found that various OpenID Providers OPs had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator CVE-2008-0166. In combination with the DNS Cache Poisoning issue CVE-2008-1447 and the fact that almost all SSL/TLS implementations do not...

CVE-2008-3280

It was found that various OpenID Providers OPs had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator CVE-2008-0166. In combination with the DNS Cache Poisoning issue CVE-2008-1447 and the fact that almost all SSL/TLS implementations do not...

GNU cflow Resource Management Error Vulnerability (CNVD-2021-36540)

GNU cflow is a flowchart generator for the GNU community that reads C source files and generates externally referenced flowcharts. A resource management error vulnerability exists in cflow version 1.6, which stems from the existence of a post-release use of the callchar name, int line function in...

Kaspersky Password Manager Encryption Problem Vulnerability

Kaspersky Password Manager is an application from the Russian company Kaspersky. It provides a function to manage passwords. Kaspersky Password Manager suffers from a cryptographic vulnerability that arises from a password generator feature that allows an attacker to predict the passwords that wi...

new module: swig:4.0

The simplified wrapper and interface generator SWIG is a software development utility to connect C, C++, and Objective C programs with a variety of high-level programming languages. SWIG is used to create high-level interpreted programming environments, systems integration, and as a utility for...

CVE-2020-27020

Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information for example, time of password generation...