Design/Logic Flaw

An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster...

CVE-2023-45875

CVE-2023-45875 affects Couchbase Server 7.2.0, where a private key leak can occur in debug.log when adding a pre-7.0 node to a 7.2 cluster. The available connected sources describe the issue and its context but do not provide a specific remediation or patched version within the documents. Practic...

CVE-2023-45875

An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster...

CVE-2023-45875

An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster...

Couchbase Server Security Vulnerability

Couchbase Server is a distributed open-source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text search and active global replication. A security vulnerability exists in Couchbase Server version 7.2.0, which stems from a private key leak in debug.log...

PT-2023-29738 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server version 7.2.0 Description: An issue was discovered in Couchbase Server where there is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster. Recommendations: For Couchbase Server version 7.2.0, consider...

rusty_paseto vulnerable to private key extraction due to ed25519-dalek dependency

Impact The vulnerability, known as RUSTSEC-2022-0093, impacts the ed25519-dalek crate, which is a dependency of the rusty-paseto crate. This issue arises from a "Double Public Key Signing Function Oracle Attack" affecting versions of ed25519-dalek prior to v2.0. These versions expose an unsafe AP...

GHSA-J57R-4QW6-58R3 rusty_paseto vulnerable to private key extraction due to ed25519-dalek dependency

Impact The vulnerability, known as RUSTSEC-2022-0093, impacts the ed25519-dalek crate, which is a dependency of the rusty-paseto crate. This issue arises from a "Double Public Key Signing Function Oracle Attack" affecting versions of ed25519-dalek prior to v2.0. These versions expose an unsafe AP...

CVE-2023-5777

Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server...

CVE-2023-5777

Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server...

Design/Logic Flaw

Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server...

CVE-2023-5777 Weintek EasyBuilder Pro Use of Hard-coded Credentials

Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server...

CVE-2023-5777 Weintek EasyBuilder Pro Use of Hard-coded Credentials

Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server...

CVE-2023-5777

CVE-2023-5777 affects Weintek EasyBuilder Pro. The root issue is use of hard-coded credentials, which can expose the private key after a crash report is sent, potentially allowing remote control of the crash report server. Affected versions are EasyBuilder Pro before v6.07.02, and 6.08.01.592 and...

Weintek EasyBuilder Pro Trust Management Issue Vulnerability

Weintek EasyBuilder Pro is Weintek's platform that provides ample high-quality graphic libraries for different industrial applications such as packaging machinery, processing plants, water treatment plants, etc., greatly reducing your project display design time. A security vulnerability exists i...

CVE-2023-44483

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

VMWare Aria Operations for Networks (vRealize Network Insight) SSH Private Key Exposure

VMWare Aria Operations for Networks vRealize Network Insight versions 6.0.0 through 6.10.0 do not randomize the SSH keys on virtual machine initialization. Since the key is easily retrievable, an attacker can use it to gain unauthorized remote access as the "support" root user. Module Options msf...

Information Disclosure

@tauri-apps/cli is vulnerable to Information Disclosure. This vulnerability is due to a commonly used misconfiguration which leads to the leakage of the private key and updater key password. If envPrefix: 'VITE', 'TAURI', was pasted from the documentation into vite.config.ts, the TAURIPRIVATEKEY...

VMWare Aria Operations For Networks SSH Private Key Exposure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/ssh' require 'net/ssh/commandstream' class MetasploitModule 'VMWare Aria Operations for Networks vRealize Network Insight SSH Private Key Exposure',...

VMWare Aria Operations For Networks SSH Private Key Exposure Exploit

VMWare Aria Operations for Networks vRealize Network Insight versions 6.0.0 through 6.10.0 do not randomize the SSH keys on virtual machine initialization. Since the key is easily retrievable, an attacker can use it to gain unauthorized remote access as the "support" root user. This module requir...