GHSA-VFP4-XX6M-7VF6 Cryptographic Issues in ECK

Elastic Cloud on Kubernetes ECK versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK...

Mageia: Security Advisory (MGASA-2016-0292)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Exploit for Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Zulip

CVE-2021-43798 Grafana 8.x Path Traversal Pre-Auth All credi...

Insecure Random Number Generator

showdoc/showdoc uses an insecure random number generator. An attack is possible when user logged in by LDAP will lead to a weak password initialization, allowing an attacker to perform a brute-force attack to break the user password...

showdoc security feature issue vulnerability

showdoc is open source and a great tool for IT teams to share documents online. showDoc is vulnerable to a security feature issue that stems from the use of an encrypted weak pseudo-random number generator PRNG. No detailed vulnerability details are currently available...

CVE-2021-3990

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

CVE-2021-3990 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdoc

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

Debian DLA-2788-1 : strongswan - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2788 advisory. Researchers at the United States of America National Security Agency NSA identified a denial of services vulnerability in strongSwan, an IKE/IPsec suite. Once the in-memory...

SUSE SLED15: strongswan / strongswan-doc / strongswan-hmac / strongswan-ipsec / etc (SUSE-SU-2021:3467-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3467-1 advisory. A feature was added: - Add authels plugin to support Marvell FC-SP encryption jscSLE-20151 Security issues fixed: - CVE-2021-41991:...

Ubuntu 18.04 LTS / 20.04 LTS : strongSwan vulnerabilities (USN-5111-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5111-1 advisory. It was discovered that strongSwan incorrectly handled certain RSASSA-PSS signatures. A remote attacker could use this issue to cause strongSw...

GitHub Revoked Insecure SSH Keys Generated by a Popular git Client

Code hosting platform GitHub has revoked weak SSH authentication keys that were generated via the GitKraken git GUI client due to a vulnerability in a third-party library that increased the likelihood of duplicated SSH keys. As an added precautionary measure, the Microsoft-owned company also said...

Path traversal

keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other libraries where possible, including node-forge. An issue was discovered where this library was generating identical RSA keys used in SSH. This wou...

Insecure random number generation in keypair

Description and Impact A bug in the pseudo-random number generator used by keypair versions up to and including 1.0.3 could allow for weak RSA key generation. This could enable an attacker to decrypt confidential messages or gain authorized access to an account belonging to the victim. We recomme...

GHSA-J85Q-WHC9-G4P9 Use of Cryptographically Weak Pseudo-Random Number Generator in showdoc

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

GHSA-HQ3V-RG6F-6HX4 Use of Insufficiently Random Values in yiisoft/yii2-dev

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator...

Use of Insufficiently Random Values in yiisoft/yii2-dev

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator...

Use of Cryptographically Weak Pseudo-Random Number Generator in yiisoft/yii2-dev

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator...

Incorrect check on buffer length in rand_core

An issue was discovered in the randcore crate before 0.6.2 for Rust. Because readu32into and readu64into mishandle certain buffer-length checks, a random number generator may be seeded with too little data. The vulnerability was introduced in v0.6.0. The advisory doesn't apply to earlier minor...

The vulnerability of the Eclipse TinyDTLS library, related to errors in the code for generating pseudo-random numbers, allows a hacker to disclose the protected information.

The vulnerability of the Eclipse TinyDTLS library is related to errors in the code of the pseudorandom number generator. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose the protected information...

CVE-2021-3047

A cryptographically weak pseudo-random number generator PRNG is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to...