CVE-2024-12432

The CVE-2024-12432 entry concerns the WPC Shop as a Customer for WooCommerce WordPress plugin, where the generate_key function produces a insufficiently random key, enabling authenticated attackers with Subscriber+ privileges to login as administrators via ajax_login. Affected versions go up to 1...

PT-2024-17592 · WordPress · Wpc Shop As A Customer For Woocommerce

Name of the Vulnerable Software and Affected Versions: WPC Shop as a Customer for WooCommerce plugin for WordPress versions prior to 1.2.9 Description: The issue affects the WPC Shop as a Customer for WooCommerce plugin for WordPress, allowing account takeover and privilege escalation. This is du...

BIT-NODE-MIN-2022-35255

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/cryptokeygen.cc. There are two problems with this: 1 It does not check the return value, it assumes EntropySource always succeeds, but it can a...

BIT-NODE-MIN-2023-30590

The generateKeys API function returned from crypto.createDiffieHellman only generates missing or outdated keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey. However, the...

The vulnerability of the openpgpGenerateKeyRsa() function in the personalization utility for smart cards PKCS15-INIT is a flaw in the software and library tools used to work with OpenSC smart cards. This vulnerability allows a perpetrator to circumvent security restrictions and execute arbitrary code.

The vulnerability of the openpgpGenerateKeyRsa function in the personalization utility for smart cards, part of the software and library suite for working with OpenSC smart cards, stems from an operation that occurs outside the buffer in memory during key generation. Exploiting this vulnerability...

CVE-2018-9426

In RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java, an incorrect implementation could cause weak RSA key pairs being generated. This could lead to crypto vulnerability with no additional execution privileges needed. User interaction is not needed for exploitation. Bulletin...

CVE-2018-9426

In RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java, an incorrect implementation could cause weak RSA key pairs being generated. This could lead to crypto vulnerability with no additional execution privileges needed. User interaction is not needed for exploitation. Bulletin...

PT-2024-10687 · Unknown · Rsakeypairgenerator

Name of the Vulnerable Software and Affected Versions: RSAKeyPairGenerator affected versions not specified Description: An incorrect implementation in RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java could cause the generation of weak RSA key pairs. This could lead to a cryp...

The vulnerability of the Simple Key-Management for Internet Protocol (SKIP) protocol implementation in the PDF viewer macro of the XWiki PDF Viewer (Pro) allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the SKIP protocol implementation in the PDF viewer macro of XWiki PDF Viewer Macro Pro relates to the improper generation of keys. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Zangi Private Messenger messaging application, related to deficiencies in the session key generation mechanism, allows a hacker to execute a “man-in-the-middle” attack.

The vulnerability of the Zangi Private Messenger messaging application is related to deficiencies in the mechanism for generating session keys. Exploiting this vulnerability could allow a remote attacker to carry out a “man-in-the-middle” attack...

goTenna Pro 安全特征问题漏洞

goTenna Pro is a series of devices from goTenna that can create networks for off-grid communications and situational awareness. A security signature issue vulnerability exists in goTenna Pro that stems from not using strong random numbers when generating its cryptographic keys...

SUSE CVE-2024-46795

In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset the binding mark of a reused connection Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding...

UBUNTU-CVE-2024-46795

In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset the binding mark of a reused connection Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in Google Android that stems from the getRegistration method in the RemoteProvisioningService.java file containing an improperly validated input, and there is a...

PT-2024-28973 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to improper input validation in the getRegistration of RemoteProvisioningService.java. This could lead to a local denial of service, where the AndroidKeyStore key...

opensc:fuzz_pkcs15init: Heap-buffer-overflow in openpgp_generate_key_rsa

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5701904112353280 Project: opensc Fuzzing Engine: honggfuzz Fuzz Target: fuzzpkcs15init Job Type: honggfuzzasanopensc Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

CGA-W2CW-H7WW-HFH9

Bulletin has no description...

Use Of A Key Past Its Expiration Date

moodle/moodle is vulnerable to Use of a Key Past its Expiration Date. The vulnerability is caused due to improper key generation, as the same key is used interchangeably for a user's QR login key and their auto-login key. This allows an attacker to exploit the same key used interchangeably for a...

CVE-2024-38277

A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two...

PT-2024-27916

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue concerns the generation of unique keys for QR login and auto-login. Currently, the same key can be used interchangeably between the two, which is insecure. A unique key shou...