UBUNTU-CVE-2020-5248

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data mu...

Hardcoded credentials

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alte...

CVE-2019-19891

CVE-2019-19891 concerns an encryption key vulnerability in Mitel SIP-DECT wireless devices (firmware versions 8.0 and 8.1) that could allow an attacker to perform a man-in-the-middle (MITM) attack and potentially intercept sensitive information. The CVE is referenced across multiple sources (NVD,...

Mitel SIP-DECT Encryption Key Vulnerability

Mitel SIP-DECT provides organizations of all sizes with a comprehensive solution for cordless IP network-based telephony by combining Session Initiation Protocol SIP innovation with DECT. An encryption key vulnerability exists in Mitel SIP-DECT using firmware versions 8.1 and 8.0, which could be...

Unspecified vulnerability in ShapeShift KeepKey finite state machine

ShapeShift KeepKey is an e-wallet device for cryptocurrency storage. An unspecified vulnerability exists in the ShapeShift KeepKey finite state machine, which stems from the program not being sufficiently authenticated. The vulnerability can be exploited to reset a portion of the encryption key t...

CVE-2011-3374

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack...

CVE-2016-10953

The Headway theme before 3.8.9 for WordPress has XSS via the license key field...

Cisco HyperFlex Software Static SSL Key Vulnerability

Cisco HyperFlex is Cisco's hyperconverged infrastructure HCI platform built to meet the needs of multi-cloud IT, supported by a simple hyperconverged infrastructure. A static SSL key vulnerability exists in Cisco HyperFlex Software versions prior to 4.01a. The vulnerability stems from inadequate...

Mozilla Firefox and Firefox ESR Denial of Service Vulnerability (CNVD-2019-22852)

Mozilla Firefox and Mozilla Firefox ESR are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. A security vulnerability exists in Mozilla Firefox versions prior to 68 and...

Siemens LOGO! 8 Hard-Coded Cryptographic Key Vulnerability

Due to the use of a hard-coded cryptographic key, an attacker can put the integrity and confidentiality of encrypted data of all Siemens LOGO! 8 PLCs using this key at risk, for instance decrypting network communication during a man-in-the-middle attack. Siemens LOGO! 8 Hard-Coded Cryptographic K...

CVE-2019-3710 DSA-2019-034: Dell EMC Networking OS10 Undocumented Default Cryptographic Key Vulnerability

Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed X.509v3 key/certificate pairs. An unauthenticated remote attacker with the knowledge of the default keys may potentially be able to...

The vulnerability of the _set_key function in the software for deploying and using the SNMP protocol Net-SNMP allows a attacker to cause a service failure.

The vulnerability of the setkey function in the “agent/helpers/tablecontainer.c” file of the SNMP Net-SNMP deployment and usage software is related to a pointer arithmetic error. Exploiting this vulnerability could allow an attacker to cause system failures and service interruptions through a...

CVE-2018-3616

Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain the TLS session key via the network...

CVE-2018-11069

RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decryption. A remote attacker may be able to recover a RSA key...

CVE-2018-16546

Amcrest networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation, as demonstrated by...

SUSE-SU-2018:2545-1 Security update for openssl1

This update for openssl1 fixes the following security issues: - CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have...

CVE-2017-13101

Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

Hardcoded credentials

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed...

CVE-2015-9258

In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might for example be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed2551...

CVE-2015-9258

In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might for example be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed2551...