PT-2020-12500 · Teclib +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.0 Description: The issue is related to an insecure encryption algorithm used in the software. The security of the encrypted data relies on the password used, and if a user sets a weak or predictable password, an...

CVE-2020-10927

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the encryption of firmware update images. The issue...

SharePort Web Access Brute Force

The vulnerability of the SharePort Web Access component of the D-Link DIR-865L router software relates to insufficiently secure data encryption. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions through brute-force attacks...

Insecure Encryption

Overview bcrypt is an A library to help you hash passwords. Affected versions of this package are vulnerable to Insecure Encryption. Data is truncated wrong when its length is greater than 255 bytes. Remediation Upgrade bcrypt to version 5.0.0 or higher. References - GitHub Issue - GitHub PR 1 -...

Unspecified Vulnerability in Software- und Organisations-Service SOS JobScheduler

Software- und Organisations-Service SOS JobScheduler is a suite of open source, enterprise-class scheduling and process automation software from Software- und Organisations-Service, Germany. A security vulnerability exists in the JOE Job Editor component of Software- und Organisations-Service SOS...

CVE-2020-12712

A vulnerability based on insecure user/password encryption in the JOE job editor component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile...

CVE-2020-12712

A vulnerability based on insecure user/password encryption in the JOE job editor component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile...

PT-2020-13221

Name of the Vulnerable Software and Affected Versions SOS JobScheduler versions 1.12 through 1.13 Description The issue is related to insecure user/password encryption in the JOE component, allowing attackers to decrypt the stored user/password. Recommendations For SOS JobScheduler versions 1.12...

CVE-2020-7263

Improper access control vulnerability in ESconfigTool.exe in McAfee Endpoint Security ENS for Windows all current versions allows local administrator to alter ENS configuration up to and including disabling all protection offered by ENS via insecurely implemented encryption of configuration for...

CVE-2013-7287

MobileIron VSP 5.9.1 and Sentry 5.0 has an insecure encryption scheme...

Code injection

MobileIron VSP 5.9.1 and Sentry 5.0 has an insecure encryption scheme...

CVE-2013-7287

MobileIron VSP 5.9.1 and Sentry 5.0 has an insecure encryption scheme...

PT-2020-7574

Name of the Vulnerable Software and Affected Versions MobileIron VSP versions prior to 5.9.1 MobileIron Sentry versions prior to 5.0 Description The issue is related to an insecure encryption scheme. Recommendations For MobileIron VSP versions prior to 5.9.1, update to version 5.9.1 or later. For...

SAP Enable Now XSS

The vulnerability of the SAP Enable Now platform exists due to deficiencies in the encryption of user-input data. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...

Insecure Encryption

Overview parsel is a gem to encrypt and decrypt data with a given key. Affected versions of this package are vulnerable to Insecure Encryption. In cases where an initialisation vector is not supplied to the encrypt or decrypt call in parsel.rb, the initialisation vector used by the library is set...

Insecure Encryption

Overview parsel is a library that allows you to encrypt and decrypt data with a given key. Affected versions of this package are vulnerable to Insecure Encryption. In cases where an initialisation vector is not supplied to the encrypt or decrypt call in parsel.rb, the initialisation vector used b...

Insecure Encryption

Overview parsel is a gem to encrypt and decrypt data with a given key. Affected versions of this package are vulnerable to Insecure Encryption. It contains a weak key derivation function, in which a key of arbitrary length is run through one round of SHA256 to gain key material of the correct...

Insecure Encryption

Overview parsel is a library that allows you to encrypt and decrypt data with a given key. Affected versions of this package are vulnerable to Insecure Encryption. It contains a weak key derivation function, in which a key of arbitrary length is run through one round of SHA256 to gain key materia...

CVE-2020-6857

CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary...

Neowise CarbonFTP 1.4 Insecure Proprietary Password Encryption Exploit

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NEOWISE-CARBONFTP-v1.4-INSECURE-PROPRIETARY-PASSWORD-ENCRYPTION.txt + twitter.com/hyp3rlinx + ISR: ApparitionSec Vendor www.neowise.com Product CarbonFTP v1.4 CarbonFTP is a...