CVE-2019-14001

Wrong public key usage from existing oemkeystore for hash generation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905,...

wolfssl

This is a collection of files related to the wolfSSL library, a cryptographic library for embedded systems. The library is designed to be compatible with Arduino projects and provides a range of cryptographic functions, including SSL/TLS, RSA, and AES. The files include: IDE/ARDUINO/README.md: A...

Arbitrary Code Execution

ntpd is vulnerable to arbitrary code execution. A buffer overflow flaw was discovered in the ntpd daemon's NTPv4 authentication code. If ntpd was configured to use public key cryptography for NTP packet authentication, a remote attacker could use this flaw to send a specially-crafted request pack...

System state backup does not include CA private keys in Windows Server 2008 or in Windows Server 2008 R2

System state backup does not include CA private keys in Windows Server 2008 or in Windows Server 2008 R2 Symptoms Assume that you use the Windows Server Backup feature to perform a system state backup on a computer that is running Windows Server 2008 or Windows Server 2008 R2. The computer has th...

PrimeKey Solutions EJBCA Code Issue Vulnerability

PrimeKey Solutions EJBCA is a software public key infrastructure certificate authority package from PrimeKey Solutions, Sweden. PrimeKey Solutions EJBCA suffers from a code issue vulnerability, no details of the vulnerability are provided at this time...

PrimeKey Solutions EJBCA Cross-Site Request Forgery Vulnerability

PrimeKey Solutions EJBCA is a software public key infrastructure certificate authority package from PrimeKey Solutions, Sweden. PrimeKey Solutions EJBCA suffers from a cross-site request forgery vulnerability for which no detailed vulnerability details are currently available...

pki-core cross-site scripting vulnerability (CNVD-2020-27179)

pki-core is a library that provides an API for PKI operations. A cross-site scripting vulnerability exists in pki-core. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

pki-core cross-site scripting vulnerability (CNVD-2020-27181)

pki-core is a library that provides an API for PKI operations. A cross-site scripting vulnerability exists in pki-core. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Security Advisory 0046

Security Advisory 0046 PDF Date: March 23, 2020 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | March 23, 2020 | Initial Release The CVE-IDs tracking this issue: CVE-2019-17596 CVSSv3 Base Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description: This advisory documents the exposure of...

DEBIAN-CVE-2019-10179

A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority KRA Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting XSS vulnerability. An attacker could trick an authenticated victim into executing special...

pki-core cross-site scripting vulnerability (CNVD-2020-27183)

pki-core is a library that provides an API for PKI operations. A cross-site scripting vulnerability exists in pki-core. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

[ASA-202003-4] golang-golang-x-crypto: denial of service

Arch Linux Security Advisory ASA-202003-4 ========================================= Severity: Medium Date : 2020-03-08 CVE-ID : CVE-2020-9283 Package : golang-golang-x-crypto Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1109 Summary ======= The package...

Holder can (re)create authentic credentials after receiving a credential in vp-toolkit

Impact The verifyVerifiableCredential method check the cryptographic integrity of the Verifiable Credential, but it does not check if the credential.issuer DID matches the signer of the credential. The verifier is impacted by this vulnerability. Patches Patch will be available in version 0.2.2...

GHSA-P94W-42G3-F7H4 Holder can (re)create authentic credentials after receiving a credential in vp-toolkit

Impact The verifyVerifiableCredential method check the cryptographic integrity of the Verifiable Credential, but it does not check if the credential.issuer DID matches the signer of the credential. The verifier is impacted by this vulnerability. Patches Patch will be available in version 0.2.2...

Security Bulletin: IBM API Connect is impacted by vulnerabilities in Golang (CVE-2019-17596 CVE-2019-16276)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-17596 DESCRIPTION: Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such...

OPENSUSE-SU-2020:0250-1 Security update for enigmail

This update for enigmail fixes the following issues: enigmail was updated to 2.1.5: Security issue: unsigned MIME parts displayed as signed bsc1159973 Ensure that upgrading GnuPG 2.0.x to 2.2.x upgrade converts keyring format Make Enigmail Compatible with Protected-Headers spec, draft 2 enigmail...

DLLPasswordFilterImplant - DLL Password Filter Implant With Exfiltration Capabilities

DLLPasswordFilterImplant is a custom password filter DLL that allows the capture of a user's credentials. Each password change event on a domain will trigger the registered DLL in order to exfiltrate the username and new password value prior successfully changing it in the Active Directory AD. Fo...

SUSE-SU-2020:0413-1 Security update for enigmail

This update for enigmail fixes the following issues: enigmail was updated to 2.1.5: Security issue: unsigned MIME parts displayed as signed bsc1159973 Ensure that upgrading GnuPG 2.0.x to 2.2.x upgrade converts keyring format Make Enigmail Compatible with Protected-Headers spec, draft 2 enigmail...

OpenSSH now supports FIDO U2F security keys for 2-factor authentication

Here's excellent news for sysadmins. You can now use a physical security key as hardware-based two-factor authentication to securely log into a remote system via SSH protocol. OpenSSH, one of the most widely used open-source implementations of the Secure Shell SSH Protocol, yesterday announced th...

OpenSSH now supports FIDO U2F security keys for 2-factor authentication

Here's excellent news for sysadmins. You can now use a physical security key as hardware-based two-factor authentication to securely log into a remote system via SSH protocol. OpenSSH, one of the most widely used open-source implementations of the Secure Shell SSH Protocol, yesterday announced th...