CVE-2021-26098

An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about the state of the device to possibly predict valid session IDs...

CVE-2021-26098

Concrete details from the connected documents describe CVE-2021-26098 as affecting Fortinet FortiSandbox’s RPC API prior to version 4.0.0. The root cause is a small space of random values used for session handling, which could let an attacker who has only a few pieces of state information about t...

HCC Embedded InterNiche 安全特征问题漏洞

HCC Embedded InterNiche is a newsletter software. An unspecified vulnerability exists in HCC Embedded InterNiche, which can be exploited to allow an attacker to be able to predict the source port of a DNS query, and then send spoofed DNS response packets that may be accepted as valid answers...

PT-2021-16954

Name of the Vulnerable Software and Affected Versions FortiSandbox versions prior to 4.0.0 Description An instance of small space of random values in the RPC API may allow an attacker in possession of a few information pieces about the state of the device to possibly predict valid session IDs...

CVE-2021-26098: Use of Insufficiently Random Values

An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about the state of the device to possibly predict valid session IDs...

Fortinet FortiSandbox 安全特征问题漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. A security signature issue vulnerability exists in the Fortinet FortiSandbox R...

PT-2021-28350

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A crash occurred due to an unknown read issue, as reported by OSS-Fuzz. The crash involves the generate inter prediction samples function within the mc...

Lessons Learned from 100 Data Breaches: Part 4, Trends in Average Volumes of Stolen Records

Imperva research shows an increase in the volume of data stolen every year. In 2020, we started to see more and more breaches that exfiltrate records in billions. Based on the analysis of thousands of data breach details published on dbdigest, we made calculations on the raw data and found some...

CVE-2021-32033

Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. The time value used by the device can be set independently from the used seed value for generating time-based one-time passwords, without authentication. Thus, a...

CVE-2021-32033: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. The time value used by the device can be set independently from the used seed value for generating time-based one-time passwords, without authentication. Thus, a...

SUSE: Security Advisory (SUSE-SU-2018:2189-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Kaspersky Password Manager Encryption Problem Vulnerability

Kaspersky Password Manager is an application from the Russian company Kaspersky. It provides a function to manage passwords. Kaspersky Password Manager suffers from a cryptographic vulnerability that arises from a password generator feature that allows an attacker to predict the passwords that wi...

imagemagick:encoder_heic_fuzzer: Use-of-uninitialized-value in void intra_prediction_sample_filtering<unsigned char>

Detailed Report: https://oss-fuzz.com/testcase?key=4892472288346112 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderheicfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: void...

Design/Logic Flaw

Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information for example, time of password generation...

From the Data Scientist’s Desk: How to Tune a Model Using Simple Analytics on the Feature Contribution Data

My story: My model looked good. It was as accurate as I wanted it to be and I was happy with it from one experiment to another. When I decided to change the test data set a bit, everything fell apart. Accuracy dropped and I had no clue why. I had to run the test again. And again. Ten tests later,...

Speculative Execution and Indirect Branch Prediction Side Channel Analysis Method

Summary: Updated Recommendations Section 04/04/2018 Today a team of security researchers disclosed several software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from many types of computing devices with many different vendors’...

New Attacks Slaughter All Spectre Defenses

All defenses against Spectre side-channel attacks can now be considered broken, leaving billions of computers and other devices just as vulnerable today as they were when the hardware flaw was first announced three years ago. A paper published on Friday by a team of computer scientists from the...

SUSE: Security Advisory (SUSE-SU-2018:1571-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2018:0006-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:1713-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...