CVE-2023-29480

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use...

Design/Logic Flaw

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is...

The vulnerability of the MinIO object storage server arises from the exposure of all environment variables, including “MINIO_SECRET_KEY” and “MINIO_ROOT_PASSWORD”, which allow attackers to expose the protected information.

The vulnerability of the MinIO object storage server lies in the fact that all environment variables, including “MINIOSECRETKEY” and “MINIOROOTPASSWORD”, are returned. Exploiting this vulnerability allows a malicious actor to expose the protected information...

The vulnerability of the NGINX Agent and the NGINX Instance Manager automation platform, related to insufficient protection of registration data, allows a perpetrator to gain access to secret keys.

The vulnerability of the NGINX Agent and the NGINX Instance Manager automation platform is related to insufficient protection of registration data. Exploiting this vulnerability can allow attackers to gain access to secret keys...

UBUNTU-CVE-2023-28432

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD, resulting in information disclosure. All users of...

MinIO 信息泄露漏洞

MinIO is an open source object storage server from MinIO, Inc. The product supports building infrastructure for machine learning, analytics, and application data workloads.MinIO is vulnerable to an information disclosure vulnerability that stems from the fact that in a cluster deployment MinIO...

MAL-2023-661 Malicious code in owa-sprite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6438db9d4289d3d8728e6308442f731128ad1d364e2d0cf6d58261f7ca7db98a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-22986 · Netflix · Netflix Lemur

Name of the Vulnerable Software and Affected Versions: Netflix Lemur versions prior to 1.3.2 Description: The issue is related to Netflix Lemur using insufficiently random values when generating default credentials. This may allow an attacker to guess the credentials and gain access to resources...

Malicious code in discord.js-lukyy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a156424566c5cc73cdef9a47310dbcfc44cf49533c5560b5fc21e1f1dedfa18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The Secret Vulnerability Finance Execs are Missing

The Other Risk in Finance A few years ago, a Washington-based real estate developer received a document link from First American – a financial services company in the real estate industry – relating to a deal he was working on. Everything about the document was perfectly fine and normal. The odd...

SUSE CVE-2013-7042

SUSE Lifecycle Management Server SLMS before 1.3.7 uses world-readable permissions for the secret keys, which allows local users to gain privileges via unspecified vectors...

SUSE CVE-2017-14737

A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover information about RSA secret keys, as demonstrated by CacheD. This occurs because an array is indexed with bits derived from a secret key...

SUSE CVE-2020-27208

The flash read-out protection RDP level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token. This allows an adversary to downgrade the RDP level and access secrets such as private ECC keys from SRAM via the debug interface...

MAL-2023-267 Malicious code in doii.repo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5201538e1c2a29415afeb2ff46b45521e0f3dc4ac5983bc3da0d42f2358bb580 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-986 Malicious code in yandex-logger-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4c81d36303d3e14463172a01a3d04fd2b8b0456c22bc8fcbc4df9fc4c27ac65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

LastPass users should move their crypto funds, experts warn

Several experts have warned LastPass users who store cryptocurrency-related login information in their vaults to change that login information as soon as they can. Apparently, cybercriminals who have access to the stolen information are making it a priority to decrypt the data in an attempt to...

Malicious code in speedtestwow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d415ef0e693ddaf1de67c1517d973f2bd74ff94ce4178530cffc9df573b09f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-249 Malicious code in dextools.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d58b956d093d028540f8fc9d9c35c21bfa0c7c42adaeb771c01b3d3478db32b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-43933 : Configuration secrets are logged in support-save

An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in support-save. Support-save file is generated by an admin user troubleshooting the switch. The Logged information may include usernames and...

MAL-2022-5317 Malicious code in pgu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0efe1392b12c8be04f7dfb30d397627dfb54764b658ac88a469f27fe59dc10eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...