CVE-2020-29505: Insufficient Entropy

Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Key Management Error Vulnerability...

[SECURITY] Fedora 36 Update: gnupg2-2.3.6-2.fc36

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

PT-2022-20972 · Marval · Marval Msm

Name of the Vulnerable Software and Affected Versions: Marval MSM version 14.19.0.12476 Description: The issue allows a low privilege user to delete other users' API Keys, including those of high privilege and the Administrator users. This is due to an Improper Access Control vulnerability...

SharpEventPersist - Persistence By Writing/Reading Shellcode From Event Log

Persistence by writing/reading shellcode from Event Log. Usage The SharpEventPersist tool takes 4 case-sensitive parameters: -file "C:\path\to\shellcode.bin" -instanceid 1337 -source Persistence -eventlog "Key Management Service". The shellcode is converted to hex and written to the "Key Manageme...

Dell EMC CloudLink 信息泄露漏洞

Dell EMC CloudLink is a flexible data encryption and key management solution from Dell, Inc. for data encryption in public, private, and hybrid cloud environments. A security vulnerability exists in Dell EMC CloudLink version 7.1.3 and prior versions. An attacker exploited the vulnerability to...

NewStart CGSL MAIN 4.05 : kernel Multiple Vulnerabilities (NS-SA-2022-0001)

The remote NewStart CGSL host, running version MAIN 4.05, has kernel packages installed that are affected by multiple vulnerabilities: - The keyctlreadkey function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properly consider that a key...

USN-5387-1: Barbican vulnerabilities

Douglas Mendizábal discovered that Barbican incorrectly handled access restrictions. An authenticated attacker could possibly use this issue to consume protected resources and possibly cause a denial of service. CVE-2022-23451, CVE-2022-23452...

barbican 授权问题漏洞

barbican is an OpenStack key management service, API server. An authorization issue vulnerability exists in barbican that allows remote users to perform unauthorized actions in the application...

The vulnerability of the OpenSSL library, related to errors in managing cryptographic keys, allows a hacker to recover secret ECDSA P-256 keys.

The vulnerability of the OpenSSL library is related to errors in the management of cryptographic keys. Exploiting this vulnerability could allow an attacker to recover encrypted keys of the ECDSA P-256 type...

3 steps to secure your multicloud and hybrid infrastructure with Azure Arc

As businesses around the world grapple with the growth of an industrialized, organized attacker ecosystem, the need for customers to secure multicloud and hybrid infrastructure and workloads is increasingly urgent. Today, organizations face an attacker ecosystem that is highly economically...

The vulnerability of the microprogramming software in Schneider Electric Easergy P5 relay protection and control devices, related to errors in SSH-key management, allows attackers to gain unauthorized access to protected information.

The vulnerability of the microprogramming software in Schneider Electric Easergy P5 relay protection and control devices is related to errors in managing SSH keys. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

How to use the Gartner® 2022 Strategic Roadmap for Data Security Platform Convergence

“It is not the strongest species that survive, nor the most intelligent, but the ones most responsive to change.” – Charles Darwin Evolution and innovation form the basis of most modern business mission statements. However, the same organizations pursuing growth and change often do not put...

ZOHO ManageEngine Key Manager Plus信息泄露漏洞

ZOHO ManageEngine Key Manager Plus is a web-based SSH secret key management solution from ZOHO. The vulnerability is caused by the application not effectively protecting the stored SSL certificates and associated key pairs, which can be exploited by an attacker to obtain the stored SSL certificat...

PT-2022-17545 · Amazon Web Services · Aws S3 Crypto Sdk

Name of the Vulnerable Software and Affected Versions: AWS S3 Crypto SDK affected versions not specified Description: The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is...

Important: kernel

Issue Overview: A flaw was found in the Linux kernels implementation of wifi fragmentation handling. An attacker with the ability to transmit within the wireless transmission range of an access point can abuse a flaw where previous contents of wifi fragments can be unintentionally transmitted to...

January 5, 2022—KB5010195 (OS Build 14393.4827) Out-of-band

None None...

December 14, 2021—KB5008218 (OS Build 17763.2366)

None None...

mongo-java-driver: client-side field level encryption not verifying KMS host name

Specific versions of the Java driver that support client-side field level encryption CSFLE fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffi...

Dell EMC CloudLink Input Validation Error Vulnerability

Dell EMC CloudLink is a flexible data encryption and key management solution for data encryption in public, private, and hybrid cloud environments.Dell EMC CloudLink 7.1 and earlier versions are vulnerable to an input validation error that could be exploited by a remote, low privilege attacker to...

Dell EMC CloudLink Arbitrary File Creation Vulnerability

Dell EMC CloudLink is a flexible data encryption and key management solution for data encryption in public, private, and hybrid cloud environments.Dell EMC CloudLink 7.1 and earlier versions contain an arbitrary file creation vulnerability that can be exploited by remote unauthenticated attackers...