CVE-2024-54137 liboqs has a correctness error in HQC decapsulation

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treat...

CVE-2024-54137: Exposure of Sensitive Information to an Unauthorized Actor

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treat...

liboqs -- Correctness error in HQC decapsulation

The Open Quantum Safe project reports: A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This results in an incorrect shared secret value being...

CVE-2024-52307 authentik allows a timing attack due to missing constant time comparison for metrics view

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

PT-2024-35168

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2024.8.5 authentik version 2024.10.3 Description The issue is related to the usage of a non-constant time comparison for the "/-/metrics/" endpoint, which made it possible to brute-force the SECRET KEY used to...

authentik 安全漏洞

authentik is an open source identity provisioning application from authentik open source. Authentik suffers from a security vulnerability that stems from an issue with the use of non-constant time comparisons in the /-/metrics/ endpoint, which makes SECRETKEY vulnerable to brute-force cracking...

CVE-2024-48952

An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints...

CVE-2024-48952

An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints...

CVE-2024-48952

A security vulnerability exists in Logpoint versions prior to 7.5.0 because the SOAR component utilizes a static JWT secret key to generate tokens. This flaw allows attackers to create custom JWT secret keys to bypass authentication and gain unauthorized access to SOAR API endpoints . To remediat...

CVE-2024-48952

An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints...

PT-2024-33294 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.5.0 Description: An issue was discovered in Logpoint where SOAR uses a static JWT secret key to generate tokens, allowing access to SOAR API endpoints without authentication. This enables attackers to create custo...

WS-2023-0314

tss-lib leaks secret keys in response to incorrectly constructed Paillier moduli - The specification of the GG18 threshold ECDSA signature protocol contains a vulnerability allowing an attacker to recover the shared secret key. If a participant generates a Paillier modulus N containing small...

COCO Annotator 安全漏洞

COCO Annotator is a web-based image annotation tool from the individual developer Justin Brooks. Designed for versatility and efficiency in labeling images. A security vulnerability exists in COCO Annotator version 0.11.1, which stems from the parameter SECRETKEY of the component Session Handler...

PT-2024-16060 · Unknown · Jsbroks Coco Annotator

Name of the Vulnerable Software and Affected Versions: jsbroks COCO Annotator version 0.11.1 Description: A problematic vulnerability was found in the Session Handler component of jsbroks COCO Annotator. The manipulation of the SECRET KEY argument leads to a predictable state from an observable...

Exploit for CVE-2024-9162

CVE-2024-9162 All-in-One WP Migration and Backup SELECT op...

Ruby On Rails Weak Secret Key

Ruby On Rails applications use an application key to encrypt and sign various data, including session cookies and other sensitive information. This key is typically stored in the .env file and is used for multiple security-critical operations. When a weak or easily guessable application key is...

Pyramid Weak Secret Key

Pyramid applications use an application key to encrypt and sign various data, including session cookies and other sensitive information. This key is typically stored in an environment variable and is used for multiple security-critical operations. When a weak or easily guessable application key i...

Laravel Weak Secret Key

Laravel applications use an application key to encrypt and sign various data, including session cookies and other sensitive information. This key is typically stored in the .env file and is used for multiple security-critical operations. When a weak or easily guessable application key is used, it...

Django Weak Secret Key

Django applications use an application key to encrypt and sign various data, including session cookies and other sensitive information. This key is typically stored in the settings.py file and is used for multiple security-critical operations. When a weak or easily guessable application key is...

CVE-2023-27584

CVE-2023-27584 affects Dragonfly2, an open-source P2P file distribution system. The vulnerability is caused by a hard-coded JWT secret key, "Secret Key", which enables authentication bypass. An attacker can perform actions with admin privileges by crafting a valid JWT token, potentially accessing...