CVE-2021-38624

Technical details about CVE-2021-38624 are not provided in the connected documents. Available records do not specify affected products/versions or fixes beyond the vulnerability title. Monitor for updates.

CVE-2021-38624 Windows Key Storage Provider Security Feature Bypass Vulnerability

...

Microsoft Windows Multiple Vulnerabilities (KB5005569)

This host is missing a critical security update according to Microsoft KB5005569 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Windows Key Storage Provider Security Feature Bypass Vulnerability

...

Microsoft Windows Key Storage Provider安全特征问题特征问题漏洞

Microsoft Windows Key Storage Provider is a Next Generation CNG from Microsoft Corporation USA that separates the encryption provider from the key storage provider KSP. A security feature issue vulnerability exists in Microsoft Windows Key Storage Provider. The following products and editions are...

PT-2021-6319 · Microsoft · Windows Key Storage Provider +1

Name of the Vulnerable Software and Affected Versions: Windows Key Storage Provider affected versions not specified Description: The issue is related to a security-feature bypass vulnerability in the Key Storage Provider KSP service of the Microsoft Windows operating system. It involves bypassing...

SUSE-SU-2021:3007-1 Security update for java-1_7_0-openjdk

This update for java-170-openjdk fixes the following issues: - Update to 2.6.27 - OpenJDK 7u311 July 2021 CPU Security fixes: - CVE-2021-2341: Improve file transfers bsc1188564 - CVE-2021-2369: Better jar file validation bsc1188565 - CVE-2021-2432: Provide better LDAP provider support bsc1188568 ...

CVE-2021-37579

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check when enabled and reaching a deserialization operation with native jav...

CVE-2021-37579

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check when enabled and reaching a deserialization operation with native jav...

FIN7 Capitalizes on Windows 11 Release in Latest Gambit

The FIN7 financial cybercrime gang is back, delivering JavaScript backdoors using Word documents themed around the next version of Windows. That’s according to researchers at Anomali, who observed a recent campaign from the group that leveraged six different docs, all referencing “Windows 11 Alph...

CVE-2021-31796

An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure. An attacker may realistically have enough information that the number of possible keys for a credential file is only one, and the number is usually not higher than 2^3...

CVE-2021-31798

The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious user can obtain the plaintext of cache files...

Design/Logic Flaw

The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious user can obtain the plaintext of cache files...

CVE-2021-31796

CVE-2021-31796 affects CyberArk Credential Provider before v12.1, where an inadequate encryption scheme (AES-256-CBC with a custom key-derivation using environmental fields) can shrink the effective key space to as little as 2^36 in realistic scenarios, enabling potential information disclosure f...

CVE-2021-31797

The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading to password disclosure...

CVE-2021-31797

The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading to password disclosure...

CVE-2021-31797

The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading to password disclosure...

Race condition

The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading to password disclosure...

CVE-2021-31798

The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious user can obtain the plaintext of cache files...

CVE-2021-31798

The CVE-2021-31798 vulnerability affects CyberArk Credential Provider prior to version 12.1, where the local encryption key space for the cached data has insufficient entropy. The cache files (configuration_cache.dat and related) are encrypted with AES-CBC and a 256-bit key, but the key derivatio...