1164 matches found
AZL-77828 CVE-2025-47278 affecting package python-flask 1.1.1-4
Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...
DEBIAN-CVE-2025-47278
Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...
UBUNTU-CVE-2025-47278
Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...
PT-2025-20926
Name of the Vulnerable Software and Affected Versions: Flask versions 3.1.0 Description: The issue arises from the incorrect handling of fallback key configuration in Flask, where the last fallback key is used for signing instead of the current signing key. This is due to Flask constructing the...
Performance Analysis of MDI-QKD in Thermal-Loss and Phase Noise Channels
Measurement-device-independent quantum key distribution MDI-QKD, enhances quantum cryptography by mitigating detector-side vulnerabilities. This study analyzes MDI-QKD performance in thermal-loss and phase noise channels, modeled as depolarizing and dephasing channels to capture thermal and phase...
OttoKit WordPress Plugin Admin Creation Vulnerability Under Active Exploitation
A newly disclosed high-severity security flaw impacting OttoKit formerly SureTriggers has come under active exploitation within a few hours of public disclosure. The vulnerability, tracked as CVE-2025-3102 CVSS score: 8.1, is an authorization bypass bug that could permit an attacker to create...
The vulnerability of the OpenSSL library, related to the hidden time channel, allows a hacker to recover the secret key.
The vulnerability of the OpenSSL library is related to a hidden time channel. Exploiting this vulnerability allows a malicious actor, operating remotely, to recover the secret key...
CVE-2024-9606
CVE-2024-9606 — Improper API key masking in Litellm A vulnerability in berriai/litellm prior to 1.44.12 arises from the masking logic in litellm_logging.py, which only masks the first 5 characters of API keys. This allows leakage of most of the secret key in logs, as noted for version v1.44.9 and...
CVE-2024-9055 DPA Countermeasures need reseeding
The DPA countermeasures on Silicon Labs' Series 2 devices are not reseeded periodically as they should be. This may allow an attacker to eventually extract secret keys through a DPA attack...
CVE-2025-2079
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT JSON Web Token sessions...
CVE-2025-2079
CVE-2025-2079 affects Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool (v3.1.2rc11). Reported issue is a hard-coded secret key that could allow an attacker to generate valid JWT sessions, potentially bypassing authentication and gaining control over the tools. Pu...
CVE-2025-2079 Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT JSON Web Token sessions...
CVE-2025-2079 Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT JSON Web Token sessions...
CVE-2024-13693
The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, and including, 6.0.9. This makes it possible for unauthenticated attackers to export all avia settings which may included sensitive...
PT-2025-7820 · WordPress · Enfold
Name of the Vulnerable Software and Affected Versions: Enfold theme for WordPress versions up to, and including, 6.0.9 Description: The issue allows unauthorized access to data due to a missing capability check in the avia-export-class.php file. This enables unauthenticated attackers to export al...
CVE-2024-3408
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...
CVE-2024-29037
datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial deployment during a limited window of tim...
MAL-2025-1177 Malicious code in sol-wallet-adapter-example (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b73b8c9916aaa68a346fd8bc05ae98f04028ce384654c5ece31bbf68657a7be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Security Bulletin: A Security Vulnerability was discovered in IBM Security Verify Access (CVE-2024-45678)
Summary A Security Vulnerability was addressed in IBM Security Verify Access regarding Yubico Yubikey 5 Series. Vulnerability Details CVEID:CVE-2024-45678 DESCRIPTION: Yubico YubiKey 5 Series, Security Key Series and YubiHSM 2 could allow a physical attacker to obtain sensitive information, cause...