Microsoft Incident Response lessons on preventing cloud identity compromise

Microsoft observed a surge in cyberattacks targeting identities in 2023, with attempted password-based attacks increasing by more than tenfold in the first quarter of 2023 compared to the same period in 2022. Threat actors leverage compromised identities to achieve a significant level of access t...

Microsoft Incident Response lessons on preventing cloud identity compromise

Microsoft observed a surge in cyberattacks targeting identities in 2023, with attempted password-based attacks increasing by more than tenfold in the first quarter of 2023 compared to the same period in 2022. Threat actors leverage compromised identities to achieve a significant level of access t...

PT-2023-7638 · Unknown · Lestrrat-Go/Jwx

Name of the Vulnerable Software and Affected Versions: lestrrat-go/jwx versions prior to 1.2.27 lestrrat-go/jwx versions prior to 2.0.18 Description: The issue is related to the JWE key management algorithms based on PBKDF2, which require a JOSE Header Parameter called p2c PBES2 Count. This...

Weak Cryptography

jose4j is vulnerable to Weak Cryptography. The vulnerability is present in Pbes2HmacShaWithAesKeyWrapAlgorithm.java due to the ability to set a small iteration count when using the PBE Password-Based Encryption algorithm. This weakness enables an attacker to determine hashed password values...

What might authentication attacks look like in a phishing-resistant future?

By Thorsten Rosendahl and Tiago Pereira, with contributions from Matthew Miller. The industry has come a long way in terms of improving how we make user authentication more secure. From the most basic concept of relying on usernames and passwords for authentication to enabling multi-factor...

SUSE CVE-2015-2936

MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service CPU consumption via a long password...

PT-2023-8391 · Jose4J · Jose4J

Name of the Vulnerable Software and Affected Versions: jose4j versions prior to 0.9.3 Description: The issue is related to the use of an algorithm that provides insufficient entropy. This allows attackers to set a low iteration count of 1000 or less, potentially enabling them to bypass security...

Wodat - Windows Oracle Database Attack Toolkit

Simple port of the popular Oracle Database Attack Tool ODAT https://github.com/quentinhardy/odat to C .Net Framework. Credit to https://github.com/quentinhardy/odat as lots of the functionality are ported from his code. Perform password based attacks e.g. username as password, username list again...

GHSA-JV3G-J58F-9MQ9 JOSE vulnerable to resource exhaustion via specifically crafted JWE

The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order...

DEBIAN-CVE-2022-36083

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...

jose 资源管理错误漏洞

npm jose is an application from the U.S. company npm. Use native encryption runtime does not depend on the item JWA, JWS, JWE, JWT, JWK. A resource management error vulnerability exists in jose versions prior to v1.28.2, prior to v2.0.6, prior to v3.20.4, and prior to v4.9.2, which stems from the...

PT-2022-23172

Name of the Vulnerable Software and Affected Versions JOSE versions prior to v1.28.2 JOSE versions prior to v2.0.6 JOSE versions prior to v3.20.4 JOSE versions prior to v4.9.2 Description The PBKDF2-based JWE key management algorithms in JOSE expect a JOSE Header Parameter named p2c PBES2 Count,...

The vulnerabilities of the microprogramming software for the Desigo DXR2, PXC3, PXC4, and PXC5 station modules allow a intruder to cause service failures.

The vulnerability of the microprogramming software for the Desigo DXR2, PXC3, PXC4, and PXC5 stations is related to an exception handling error. Exploiting this vulnerability could allow a perpetrator to cause service failures by installing a key derived from PBKDF2...

Shadow Credentials

Microsoft has introduced Windows Hello for Business WHfB to replace traditional password based authentication with a key based trust model. This implementation uses PIN or… Continue reading - Shadow Credentials...

Mageia: Security Advisory (MGASA-2017-0460)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EAP-pwd 加密问题漏洞

EAP-pwd is an EAP authentication method that uses a shared password for authentication. A cryptographic issue vulnerability exists in EAP-pwd that stems from a cache access mode error in the hostapd and wpa supplicant components of the product. An attacker could use this vulnerability to launch a...

SUSE: Security Advisory (SUSE-SU-2019:1088-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Git Authorization Problem Vulnerability

Git is a free, open source distributed version control system. Git version 1.7.3 suffers from an authorization issue vulnerability that stems from the ability to use passwords for unexpected resources. In order to exploit, a user must perform a git pull operation, decrypt the password, and use th...

Huawei EulerOS: Security Advisory for java-1.7.0-openjdk (EulerOS-SA-2017-1330)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Broadcom Brocade SANnav Encryption Issue Vulnerability

Broadcom Brocade SANnav is a suite of SAN management platforms from Broadcom USA. A security vulnerability exists in the encryption key generation process in the PBE algorithm of Broadcom Brocade SANnav versions prior to 2.0. An attacker can exploit this vulnerability to decrypt passwords...