CVE-2019-16340: Direct Request

Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfojson.cgi URI...

PT-2019-14634

Name of the Vulnerable Software and Affected Versions Belkin Linksys Velop version 1.1.8.192419 Description The issue allows remote attackers to discover the recovery key by making a direct request for the "/sysinfo json.cgi" API endpoint. Recommendations For version 1.1.8.192419, as a temporary...

Nextcloud: Improper integrity protection of server-side encryption keys

The public keys used for the server-side encryption are not integrity-protected. These can easily replaced by anyone who has access to the data-at-rest data even when the per-user-keys are enabled, as described in https://nextcloud.com/security/threat-model/. This holds true for all key types -...

Microsoft Windows: BitLocker-protected removable drives recovery (key)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winrmbitlockerrecoverykey.nasl 11363 2018-09-12 13:46:05Z emoss $ Check value for Choose how BitLocker-protected removable drives can be recovered: Recovery Key Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone...

Microsoft Windows: BitLocker-protected operating system drives recovery (key)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winosbitlockerkey.nasl 11363 2018-09-12 13:46:05Z emoss $ Check value for Choose how BitLocker-protected operating system drives can be recovered: Recovery key Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone...

Microsoft Windows: Recovering of BitLocker-protected fixed drives (Recovery Key)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winbitlockerrecoverykey.nasl 11363 2018-09-12 13:46:05Z emoss $ Check value for Choose how BitLocker-protected fixed drives can be recovered: Recovery Key Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks...

Bitlocker Device Policy

Windows 10 Enterprise includes a disk encryption feature called BitLocker, which provides extra file and system protections against unauthorized access of a lost or stolen device. For more protection, you can use BitLocker with Trusted Platform Module TPM chips, version 1.2 or later. A TPM chip...

Microsoft Keeps Backup of Your Encryption Key on its Server — Here's How to Delete it

Have you recently purchased a Windows computer? Congratulations! As your new Windows computer has inbuilt disk encryption feature that is turned on by default in order to protect your data in case your device is lost or stolen. Moreover, In case you lost your encryption keys then don't worry,...

Bitlocker Master Key (FVEK) Extraction

This module enumerates ways to decrypt Bitlocker volume and if a recovery key is stored locally or can be generated, dump the Bitlocker master key FVEK This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Moodle 'lib/moodlelib.php' predictable random number generation vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A predictable random number generation vulnerability exists in Moodle. An attacker cou...

New Utility Decrypts Files Lost to TeslaCrypt Ransomware

Crypto-ransomware variants have enterprises on edge because of the threat of irreversibly damaged files. Some organizations, including most recently the Tewksbury, Ma., police department have gone as far as to pay hundreds of dollars in ransom for the recovery key. Some technology companies are...

Apple Takes Tool offline After New Security Hole Surfaces

Less than a day after Apple announced a new two-factor authentication to better protect Apple ID and iCloud accounts, the company was scrambling to fix another major security hole with its own password reset tool. As first reported earlier Friday by The Verge, this new exploit allows anyone to ga...

Apple adds two-factor authentication to iCloud and Apple ID

Apple is beefing up the security of its iCloud and Apple ID accounts by adding two-factor authentication to the account login process. Users who activate the option will be required to enter a four-digit code they may receive via SMS message, aside from the usual password. Two-factor authenticati...

FreeBSD : mozilla -- multiple vulnerabilities (0a9e2b72-4cb7-11e1-9146-14dae9ebcf89)

The Mozilla Project reports : MFSA 2012-01 Miscellaneous memory safety hazards rv:10.0/ rv:1.9.2.26 MFSA 2012-02 Overly permissive IPv6 literal syntax MFSA 2012-03 iframe element exposed across domains via name attribute MFSA 2012-04 Child nodes from nsDOMAttribute still accessible after removal ...

CVE-2009-3278

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 use the rand library function to generate a certain recovery key, which makes it easier for local users to determine this key via a brute-force attack...

CVE-2009-3200

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create an undocumented recovery key and store it in the ENCK variable in flash memory, which allows local users to bypass the passphrase requirement and decrypt the hard drive by reading this variable,...

Design/Logic Flaw

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create an undocumented recovery key and store it in the ENCK variable in flash memory, which allows local users to bypass the passphrase requirement and decrypt the hard drive by reading this variable,...

Design/Logic Flaw

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 use the rand library function to generate a certain recovery key, which makes it easier for local users to determine this key via a brute-force attack...

CVE-2009-3278

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 use the rand library function to generate a certain recovery key, which makes it easier for local users to determine this key via a brute-force attack...

PT-2009-5592 · Qnap · Qnap Ts-639 Pro +1

Name of the Vulnerable Software and Affected Versions: QNAP TS-239 Pro and TS-639 Pro versions 2.1.7 0613, 3.1.0 0627, 3.1.1 0815 Description: The issue allows local users to determine a certain recovery key via a brute-force attack because the rand library function is used to generate this key...