CVE-2017-0379: Exposure of Sensitive Information to an Unauthorized Actor

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c...

CVE-2016-7440

The C software implementation of AES Encryption and Decryption in wolfSSL formerly CyaSSL before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences...

CVE-2016-7440: Undefined Security Weakness

The C software implementation of AES Encryption and Decryption in wolfSSL formerly CyaSSL before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences...

CVE-2016-7439: Undefined Security Weakness

The C software implementation of RSA in wolfSSL formerly CyaSSL before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences...

PT-2016-5160 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions 5.x through 6.x Description: The AES-GCM specification in RFC 5084 recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover ...

CVE-2016-0702

The MODEXPCTIMECOPYFROMPREBUF function in crypto/bn/bnexp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the...

RSI Video Technologies Frontel Hard-Coded Encryption Vulnerability

RSI Video Technologies Frontel is a suite of receiver software for monitoring Videofied wireless video alarm systems from the French company RSI Video Technologies. A security vulnerability exists in RSI Video Technologies Frontel that stems from the program's use of a pre-shared key that is...

Open-Xchange OX Guard SQL Injection Vulnerability

Open-Xchange OX Guard is a security suite for email and documents. A SQL injection vulnerability exists in the public key discovery API calls of Open-Xchange OX Guard, which allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or obtain...

CVE-2015-5703

SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5703: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

The vulnerability of the microprogramming software of the Cisco Unified Communications Manager allows a remote attacker to bypass the device protection mechanisms.

The vulnerability in the key generator implementation util/keygen.c allows a malicious individual to discover the key through brute-force attacks...

PT-2017-6668 · Nts +3 · Ntp +3

Name of the Vulnerable Software and Affected Versions: ntp versions 4.2.8px through 4.2.8p2-RC2 ntp versions 4.3.x through 4.3.12 Description: The issue is related to the generation of MD5 keys with insufficient entropy on big endian machines under specific conditions. This might allow remote...

Stunnel: RSA timing attacks / key discovery

Release Date: 2003-Mar-21 Package: stunnel Versions: Stunnel 3.x x = 22 Stunnel 4.x x = 04 Problem type: Key discovery / Information Leakage Exploit script: None publicly available Severity: High Network-accessible: yes Network-accessible: yes Discovery: D. Boneh, D. Brumley Writeup: Brian Hatch...

SSH 1.2.x - Secure-RPC Weak Encrypted Authentication

// source: https://www.securityfocus.com/bid/2222/info SSH is a package designed to encrypt traffic between two end points using the IETF specified SSH protocol. The SSH1 package is distributed and maintained by SSH Communications Security. A problem exists which could allow the discovery of the...