CVE-2013-7463

The CVE refers to the aescrypt gem (Ruby) version 1.0.0, where CBC IVs are not randomized for AESCrypt.encrypt and AESCrypt.decrypt. This omission enables a chosen-plaintext attack that defeats cryptographic protection. The NVD entry lists CVSS v3.0 base score 7.5 (HIGH) with network attack, no p...

CVE-2013-7463

The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack...

Security Advisory - Plaintext Storage of Users’ Safe Passwords in the Files APP in Huawei Mobile Phones

The Files APP in some Huawei mobile phones has a vulnerability of plaintext storage of users' Safe passwords. An attacker with the root privilege of an Android system could forge the Safe to read users' plaintext Safe passwords, leading to information leak. Vulnerability ID: HWPSIRT-2017-03222 Th...

CVE-2017-2665

The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any local user who has access to system running skyring service will be able to get password in plai...

Huawei Files Plaintext Storage Password Vulnerability

Huawei Files is a file management APP software on cell phones from Huawei China. A plaintext storage password vulnerability exists in Huawei Files 7.1.0.308 and earlier versions. An attacker can read the plaintext password information of a user's confidential cabinet by spoofing the related...

DLL Hijacking Vulnerability and Information Disclosure Vulnerability in CIMCO Software

CIMCO is the world's leader in DNC solutions and is the world's largest installed base of DNC systems, which are mainly used for networking communication of CNC machine tools, machine tool monitoring, etc. CIMCO DNC-Max Server is the DNC server software. Vulnerability one: CIMCO program default...

WirelessGear Siklu EtherHaul Remote Code Execution Vulnerability (CNVD-2017-04887)

WirelessGear Siklu EtherHaul radios are a set of radios for commercial service from WirelessGear USA. A remote command execution vulnerability exists in WirelessGear Siklu EtherHaul versions prior to 7.4.0. A remote attacker could exploit this vulnerability to unauthorizedly execute commands to...

CVE-2017-7318

Siklu EtherHaul devices before 7.4.0 are vulnerable to a remote command execution RCE vulnerability. This vulnerability allows a remote attacker to execute commands and retrieve information such as usernames and plaintext passwords from the device with no authentication...

PT-2017-17662

Name of the Vulnerable Software and Affected Versions: Siklu EtherHaul versions prior to 7.4.0 Description: The issue allows a remote attacker to execute commands and retrieve sensitive information, including usernames and plaintext passwords, from the device without requiring authentication...

Cloudera Navigator Security Bypass Vulnerability

Cloudera Navigator is a suite of data management tools for Hadoop platform integration from Cloudera, USA. The tool provides features such as auditing data access and validating access rights, searching metadata, and visualization. A security bypass vulnerability exists in Cloudera Navigator. An...

New Relic: SSL Padding Oracle On Downgraded Legacy Encryption (POODLE) Vulnerability

Hi, I get in touch to report that cloud.newrelic.com is vulnerable to CVE-2014-3566 POODLE. Websites that support SSLv3 and CBC-mode ciphers are potentially vulnerable to an active MITM Man-in-the-middle attack. This attack, called POODLE, is similar to the BEAST attack and also allows a network...

Design/Logic Flaw

xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector IV for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this...

CVE-2016-6225

xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector IV for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this...

CVE-2016-6225

xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector IV for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this...

UBUNTU-CVE-2016-6225

xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector IV for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this...

CVE-2016-6225

xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector IV for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this...

CVE-2016-6225

CVE-2016-6225 affects Percona XtraBackup’s xbcrypt: versions prior to 2.3.6 (and 2.4.x prior to 2.4.5) fail to properly set the initialization vector (IV) for encryption, enabling context-dependent attackers to potentially obtain sensitive data from encrypted backups via a Chosen-Plaintext attack...

SICUNET Access Controller Multiple Vulnerabilities

SICUNET Access Controller is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

chromium-browser: incorrect handling of cookies in cast

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent...

CVE-2017-5042

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent...