ROS-20240503-08

Vulnerability in the ECDSA private key signature generation component of the client software for various Putty remote access protocols is related to the possibility of secret key recovery. key. Exploitation of the vulnerability could allow a remote intruder to hijack a session by recovering the...

CVE-2024-32604 WordPress WP-Recall plugin <= 16.26.5 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.5...

PT-2024-13214 · Octopus Deploy +1 · Octopus Server

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue allows an API key to be logged in clear text in the audit log file after an invalid login attempt. Recommendations: At the moment, there is no information about a newer version...

WordPress Language Translate Widget for WordPress – ConveyThis plugin <= 223 - Unauthenticated Stored Cross-Site Scripting via api_key vulnerability

Unauthenticated Stored Cross-Site Scripting via apikey vulnerability discovered by Krzysztof Zając in WordPress Plugin ConveyThis versions = 223...

CVE-2024-31296 WordPress BookingPress plugin <= 1.0.81 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81...

Hardcoded credentials

Use of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could compromise the cryptographic keys...

CVE-2023-38535

Use of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could compromise the cryptographic keys...

Authorization

An authorization bypass through user-controlled key vulnerability CWE-639 in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticat...

The vulnerability of the eSmartCam surveillance application for wireless cameras of the ElinkSmart SKY30W series lies in the use of a rigidly encrypted cryptographic key called AES. This vulnerability allows a intruder to gain unauthorized access to protected information and carry out a “man-in-the-middle” attack.

The vulnerability of the eSmartCam surveillance application for wireless cameras of the ElinkSmart SKY30W series lies in the use of a rigidly encrypted cryptographic key called AES. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential key use-after-free When ieee80211keylink is called by ieee80211gtkrekeyadd but returns 0 due to KRACK protection identical key reinstall, ieee80211gtkrekeyadd will still return a pointer into the key...

CVE-2023-52161

The Access Point functionality in eapolauthkeyhandle in eapol.c in iNet wireless daemon IWD before 2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key...

CVE-2023-6451

CVE-2023-6451 affects AlayaCare’s Procura Portal prior to version 9.0.1.2. The issue is a publicly known cryptographic machine key that enables attackers to forge authentication cookies and bypass login mechanisms. Affected product: Procura Portal (AlayaCare). Impact: unauthorized access to authe...

WP Spell Check < 9.18 - Cross-Site Request Forgery

Description The WP Spell Check plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.17. This is due to missing or incorrect nonce validation on the wpscxadminemptyrender function. This makes it possible for unauthenticated attackers to update an...

Hardcoded credentials

VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the password of a specific product user...

CVE-2023-48223 fast-jwt JWT Algorithm Confusion

fast-jwt provides fast JSON Web Token JWT implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match all common PEM formats for public keys. ...

GHSA-3J2F-58RQ-G6P7 Sureness uses hardcoded key

Dromara Sureness before v1.0.8 was discovered to use a hardcoded key...

CVE-2023-42492

EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key...

CVE-2023-43634 Config Partition Not Protected by Measured Boot

When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configuration is not protected by the secure boot, and in response Zededa implemented measurements on the config partition that was mapped to PCR 13. I...

Debian dla-3530 : libssl-dev - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3530 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3530-1 [email protected]...

CVE-2023-3632

CVE-2023-3632 affects the Kunduz - Homework Helper App by Sifir Bes Education and Informatics Kunduz. Root cause described in multiple sources as a hard-coded cryptographic key leading to authentication abuse/bypass . Affected versions are listed as prior to 6.2.3. The CVSS-based metrics indicate...