Design/Logic Flaw

A PIN management problem was discovered on Yubico YubiKey 5 devices 5.2.0 to 5.2.6. OpenPGP has three passwords: Admin PIN, Reset Code, and User PIN. The Reset Code is used to reset the User PIN, but it is disabled by default. A flaw in the implementation of OpenPGP sets the Reset Code to a known...

CVE-2020-15000

A PIN management problem was discovered on Yubico YubiKey 5 devices 5.2.0 to 5.2.6. OpenPGP has three passwords: Admin PIN, Reset Code, and User PIN. The Reset Code is used to reset the User PIN, but it is disabled by default. A flaw in the implementation of OpenPGP sets the Reset Code to a known...

CVE-2020-15000

The CVE-2020-15000 entry describes a PIN management flaw in Yubico YubiKey 5 devices (versions 5.2.0–5.2.6) where a Reset Code is set to a known value at initialization due to a flaw in OpenPGP. If the Reset Code retry counter is enabled (non-zero) without changing the Reset Code, this known valu...

PT-2020-14109

Name of the Vulnerable Software and Affected Versions Yubico YubiKey 5 devices versions 5.2.0 through 5.2.6 Description A PIN management problem was discovered in Yubico YubiKey 5 devices. The issue involves OpenPGP, which has three passwords: Admin PIN, Reset Code, and User PIN. The Reset Code,...

CVE-2020-15000: Undefined Security Weakness

A PIN management problem was discovered on Yubico YubiKey 5 devices 5.2.0 to 5.2.6. OpenPGP has three passwords: Admin PIN, Reset Code, and User PIN. The Reset Code is used to reset the User PIN, but it is disabled by default. A flaw in the implementation of OpenPGP sets the Reset Code to a known...

CVE-2019-20883

An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post...

CVE-2019-20883

An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post...

CVE-2019-20883: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post...

Design/Logic Flaw

The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used proximity chip keys RFID tokens. This makes it easier for an attacker to disarm the wireless alarm system...

CVE-2020-14157

CVE-2020-14157 affects ABUS Secvest FUBE50001: the wireless-communication feature transmits PIN codes and RFID token IDs without encryption. Root cause is missing encryption for sensitive data in the wireless channel, enabling an attacker to disarm the wireless alarm system. Documents explicitly ...

CVE-2020-14157: Cleartext Transmission of Sensitive Information

The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used proximity chip keys RFID tokens. This makes it easier for an attacker to disarm the wireless alarm system...

CVE-2020-14077

TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action setstaenrolleepinwifi1 or setstaenrolleepinwifi0 with a sufficiently long wpsstaenrolleep...

PT-2020-13882

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-827DRU versions through 2.06B04 Description The issue is a stack-based buffer overflow in the ssi binary, allowing an authenticated user to execute arbitrary code. This can be achieved by sending a POST request to the "apply.cgi"...

CVE-2020-0148

In btuhcifpincoderequestevt, btuhciflinkkeyrequestevt, and btuhciflinkkeynotificationevt of btuhcif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure via compromised device firmware with System execution privileges needed. Us...

QIWI: PIN OK attack

PIN OK attack is an attack when a wedge-device created for MiTM is used to substitute the response from the card during an offline-PIN check and say that PIN was correct. Reproduction steps: An attacker with a stolen card without the correct PIN knowledge can use either a so-called wedge device f...

Cryptocurrency Hardware Wallets Can Get Hacked Too

New research shows vulnerabilities in popular cold-storage options that would have revealed their PINs...

CVE-2020-6861

A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the master spending key by sending crafted messages to this app selected on a PIN-entered Ledger connected to a host PC...

CVE-2020-6861

A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the master spending key by sending crafted messages to this app selected on a PIN-entered Ledger connected to a host PC...

CVE-2020-6861

A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the master spending key by sending crafted messages to this app selected on a PIN-entered Ledger connected to a host PC...

The vulnerability of the `generate` function in the Werkzeug web application library, which allows an attacker to gain unauthorized access to confidential data.

The vulnerability of the generate function in the Werkzeug web application library’s init.py file is related to a lack of entropy in the PIN selection process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to confidential data...