CVE-2020-11792

NETGEAR R8900, R9000, RAX120, and XR700 devices before 2020-01-20 are affected by Transport Layer Security TLS certificate private key disclosure...

CVE-2020-11792

CVE-2020-11792 affects NETGEAR devices: R8900, R9000, RAX120, and XR700 released before 2020-01-20, where the TLS certificate private key disclosure vulnerability exists. The root cause is disclosure of the TLS private key; no concrete exploit details are provided in the supplied documents. There...

CVE-2020-11792: Improper Certificate Validation

NETGEAR R8900, R9000, RAX120, and XR700 devices before 2020-01-20 are affected by Transport Layer Security TLS certificate private key disclosure...

PT-2020-12850

Name of the Vulnerable Software and Affected Versions NETGEAR R8900 versions prior to 2020-01-20 NETGEAR R9000 versions prior to 2020-01-20 NETGEAR RAX120 versions prior to 2020-01-20 NETGEAR XR700 versions prior to 2020-01-20 Description The issue concerns the disclosure of Transport Layer...

Edimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Edimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution Exploit Author: Wadeek Hardware Version: EW-7438RPn-v3 Mini Firmware Version: 1.23 / 1.27 Vendor Homepage:...

PT-2020-2276

Name of the Vulnerable Software and Affected Versions MSR JavaScript Cryptography Library affected versions not specified Description A security issue exists in the MSR JavaScript Cryptography Library due to multiple bugs in its Elliptic Curve Cryptography ECC implementation. This could allow an...

CVE-2020-9043

The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key...

Information disclosure

The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks...

JVN#37183636: Trend Micro Password Manager vulnerable to information disclosure

Password Manager provided by Trend Micro Incorporated generates a key pair and a root certificate on product installation. The generated private key is not properly protected and any non-administrative user can retrieve the private key CWE-200. Impact A malicious user who obtains the private key...

PT-2020-4103

Name of the Vulnerable Software and Affected Versions: Apache CXF versions prior to 3.2.12 Apache CXF versions prior to 3.3.5 Description: The issue is related to the OpenId Connect JWK Keys service in Apache CXF, which can return private key and secret key credentials if the user has configured...

Infineon RSA Library Key Disclosure

The vulnerability of Infineon’s RSA Library is related to errors in generating prime numbers using the RSA algorithm. Exploiting this vulnerability could allow a malicious actor to disclose the secret part of the key...

PT-2019-13604

Name of the Vulnerable Software and Affected Versions wolfSSL and wolfCrypt versions 4.1.0 and earlier Description The issue allows a remote attacker to compute the long term private key from several hundred DSA signatures via a lattice attack. This occurs because the dsa.c file fixes two bits of...

CVE-2019-16340: Direct Request

Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfojson.cgi URI...

ECDH Private Key Disclosure

openpgp.js is vulnerable to ECDH Private Key disclosure. The vulnerability exists due to an invalid curve attack resulted from allowing an attacker to forge messages to gain feedback on whether a decryption is successful...

CVE-2016-10863

Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure...

CVE-2016-10863: Cross-Site Request Forgery (CSRF)

Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure...

PT-2019-7659

Name of the Vulnerable Software and Affected Versions Edimax Wi-Fi Extender devices affected versions not specified Description The issue allows for CSRF, potentially leading to PSK key disclosure through the goform/formwlencryptvxd endpoint. Recommendations At the moment, there is no information...

CloudBees Jenkins Amazon EC2 Plugin Information Disclosure Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Amazon EC2 Plugin is used in which an EC2 connection agen...

CVE-2019-13179

Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /cryptokeyfile.bin mode 0600 owned by root to /boot within a globally readable initramfs image with insecure permissions, which allows this originally protected file to be read by any user, thereby disclosing decryption...

USN-4035-1 ceph vulnerabilities

It was discovered that Ceph incorrectly handled read only permissions. An authenticated attacker could use this issue to obtain dm-crypt encryption keys. This issue only affected Ubuntu 16.04 LTS. CVE-2018-14662 It was discovered that Ceph incorrectly handled certain OMAPs holding bucket indices...