CVE-2024-36391

MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic...

CVE-2024-36391 MileSight DeviceHub - CWE-320: Key Management Errors

MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic...

CVE-2024-36391 MileSight DeviceHub - CWE-320: Key Management Errors

MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic...

CVE-2024-36391: Undefined Security Weakness

MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic...

PT-2024-3995

Name of the Vulnerable Software and Affected Versions MileSight DeviceHub affected versions not specified Description The issue is related to key management errors, which may allow authentication bypass and man-in-the-middle traffic. This could enable a remote attacker to perform a...

ROS-20240319-01

A vulnerability in the SSH protocol implementation is related to the ability to adjust packet sequence numbers during the connection negotiation process and remove an arbitrary number of SSH service messages. during the connection negotiation process and cause an arbitrary number of SSH service...

CISA and NSA Release Cybersecurity Information Sheets on Cloud Security Best Practices

Today, CISA and the National Security Agency NSA released five joint Cybersecurity Information Sheets CSIs to provide organizations with recommended best practices and/or mitigations to improve the security of their cloud environments. Use Secure Cloud Identity and Access Management Practices Use...

CVE-2023-52530 wifi: mac80211: fix potential key use-after-free

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential key use-after-free When ieee80211keylink is called by ieee80211gtkrekeyadd but returns 0 due to KRACK protection identical key reinstall, ieee80211gtkrekeyadd will still return a pointer into the key...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from deficiencies in access control. This allows a malicious individual to alter the headers of deployment keys.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in SSH key management during automated deployment scenarios. Exploiting this vulnerability could allow a malicious actor to modify the headers of deployment private keys...

RAID Technology and the importance of disk encryption in data security

Introduction Recently we were engaged by a client experiencing a potential data leak incident. Amidst their expansion, they were constructing a new data centre. Due to pressing business needs, they accelerated the setup of part of their infrastructure. This urgency led to them setting up a Domain...

The vulnerability of the ssh-agent agent in the OpenSSH encryption protection mechanism allows attackers to disclose the protected information.

The vulnerability of the ssh-agent agent in the OpenSSH encryption protection mechanism is related to key management errors. Exploiting this vulnerability can allow attackers to disclose the protected information...

PT-2023-7885

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 9.6 Description The issue is related to errors in key management in the ssh-agent tool of OpenSSH. It allows an attacker to disclose protected information by exploiting certain destination constraints that are not ful...

GO-2023-2379 Denial of service due to malicious parameters in github.com/lestrrat-go/jwx

The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c PBES2 Count. This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force...

SUSE-SU-2023:4672-1 Security update for suse-build-key

This update for suse-build-key fixes the following issues: This update runs a import-suse-build-key script. The previous libzypp-post-script based installation is replaced with a systemd timer and service bsc1217215 bsc1216410 jscPED-2777. - suse-build-key-import.service -...

lestrrat-go/jwx's malicious parameters in JWE can cause a DOS

Summary too high p2c parameter in JWE's alg PBES2- could lead to a DOS attack Details The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c PBES2 Count. This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary...

CVE-2023-28556

Cryptographic issue in HLOS during key management...

Design/Logic Flaw

Cryptographic issue in HLOS during key management...

CVE-2023-28556

Technical details for CVE-2023-28556 are not publicly provided in the supplied documents. No concrete affected products, versions, root cause or fixes are disclosed here. Monitor for updates from vendors and security bulletins.

CVE-2023-28556 Improper Authorization in HLOS

Cryptographic issue in HLOS during key management...

PT-2023-21803 · Hlos · Hlos

Name of the Vulnerable Software and Affected Versions: HLOS affected versions not specified Description: A cryptographic issue exists in HLOS during key management. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...