The vulnerability of the AES-128-CBC encryption algorithm in the microprogramming-based router software Tenda RX2 Pro allows a hacker to disclose the protected information.

The vulnerability of the AES-128-CBC encryption algorithm in the microprogramming-based router software Tenda RX2 Pro relates to the storage of encryption keys in an open manner. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

CVE-2024-48310

AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backend API or other sensitive information...

AutoLib Software Systems OPAC 20.10 Secret Disclosure

AutoLib Software Systems OPAC version 20.10 discloses multiple API keys within the source code. Attackers may use these keys to access the backend API or other sensitive information. + Credits: Shahnawaz Shaikh, Security Researcher at Cybergate Defense LLC + twitter.com/striv3r Vendor Autolib-ind...

CVE-2024-48310

AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backend API or other sensitive information...

MAL-2024-10698 Malicious code in commitlint-config-jira-type-infra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3a60114c639e9e20430efd4c98505d38340a52eece4ea1eb6eca3117556cc63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8587 Malicious code in @diotoborg/ratione-animi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99fbce442b156c6ca8741c6adc28f303a48f96a03c4ed901e5665e96c520f9d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-366 Malicious code in wlwz-2312-2107 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4e0473238cfdc7e52ebe6ae11e6dc9575d8ca45278ee0fcea1fd6d19420a783 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Duplicate Advisory: Discovery uses the same AES/GCM Nonce throughout the session

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w3hj-wr2q-x83g. This link is maintained to preserve external references. Original Description Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally...

PT-2023-28752 · Broadcom · Broadcom Raid Controller

Name of the Vulnerable Software and Affected Versions: Broadcom RAID Controller affected versions not specified Description: The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data. The keys used for encryption are accessible to any local user on Linux...

SUSE CVE-2023-4237

A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availabili...

Fortinet FortiOS和FortiAuthenticator 安全漏洞

Fortinet FortiOS and Fortinet FortiAuthenticator are both products of Fortinet, Inc. Fortinet FortiOS is a security operating system dedicated to the FortiGate network security platform. The system provides users with a variety of security features such as firewall, antivirus, IPSec/SSLVPN, Web...

CVE-2023-2632 API keys stored and displayed in plain text by Code Dx Plugin

Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

MAL-2023-492 Malicious code in hardhat-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9ecd6650e933188001d304f60e4bdc5a7820065595396fe796ba8d86eb3bda7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-20328 · Gradio · Gradio

Name of the Vulnerable Software and Affected Versions: Gradio versions prior to 3.13.1 Description: Gradio is an open-source Python library to build machine learning and data science demos and web applications. When using Gradio's share links by setting share=True, a private SSH key is sent to an...

MAL-2023-83 Malicious code in agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dd87cf4d9e1e62b56ac8a65012bd4d49c2653e205f6eea7ef15b67deb469100 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3592 Malicious code in helix-rum-collector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 002b86a6a7d367dc196dbac6c12dff9827ed2b0a483cb8520063a9f3e90c513b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2345 Malicious code in datadog-app-example-random-dog-dog-image-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b50dcc4d3984665cd138c5e4d7a07df4b4516229793751b28f80309508902d51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-43512

An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified consequences due to being able to decompile a local application and extract their API keys...

MAL-2022-3968 Malicious code in isomorphic-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77d4d391965bb7a4c11a66a561e0658812b791204239bf258a2d48675c730c8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-29052

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...