EUVD-2026-115124

@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value as invalid, still...

CVE-2019-5420

CVE-2019-5420 A vulnerability can allow an attacker to guess the automatically generated development mode secret token. Ruby-on-Rails when it is running in development mode. In development mode, it is possible for an attacker to guess the key used to secure the sessions. Decryption: Key Generate:...

GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the serve...

PT-2026-126663

Name of the Vulnerable Software and Affected Versions GoAhead versions 3.4.5 through 6.1.0 Description GoAhead is a small web server used in routers, printers, and industrial controllers. A flaw exists where the server loads the Certificate Revocation List CRL but fails to apply it. This allows...

EUVD-2026-70819

A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...

CVE-2026-18330

A hard-coded cryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5. The same RSA-1024 private key is stored within firmware configuration files and reused across devices. An attacker who obtains the private key and captures an HTTP Web UI login session may use the key to...

EUVD-2017-6985

Malware in sbrugna...

EUVD-2015-7656

Malware in sbrugna...

EUVD-1999-1079

Malware in sbrugna...

EUVD-2004-0925

Malware in sbrugna...

CVE-2004-0927

ServerAdmin in Mac OS X 10.2.8 through 10.3.5 uses the same example self-signed certificate on each system, which allows remote attackers to decrypt sessions...

CVE-2022-20940

A vulnerability in the TLS handler of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to gain access to sensitive information. This vulnerability is due to improper implementation of countermeasures against a Bleichenbacher attack on a device that uses...

PT-2018-6791

Name of the Vulnerable Software and Affected Versions: Symantec IntelligenceCenter version 3.3 Description: The issue allows a remote attacker to establish large numbers of crafted SSL connections to the target and obtain the session keys required to decrypt a pre-recorded SSL session, by...

PT-2018-5905

Name of the Vulnerable Software and Affected Versions: Symantec SSL Visibility SSLV versions 3.8.4FC through 3.10 prior to 3.10.4.1 Symantec SSL Visibility SSLV version 3.11 Symantec SSL Visibility SSLV versions 3.12 prior to 3.12.2.1 Description: The issue allows a remote attacker, who has...

CVE-2018-5507: Undefined Security Weakness

On F5 BIG-IP versions 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5, vCMP guests running on VIPRION 2100, 4200 and 4300 series blades cannot correctly decrypt ciphertext from established SSL sessions with small MTU...

BSA-2018-514

Security Advisory ID : BSA-2018-514 Component : TLS Implementations Revision : 1.1: Final TLS implementations may disclose side channel information via discrepancies between valid and invalid PKCS1 padding, and may therefore be vulnerable to Bleichenbacher-style attacks. An attacker could...

Google Chrome Security Bypass Vulnerability (CNVD-2017-07170)

Google Chrome is a web browser developed by the American company Google Google. A security bypass vulnerability exists in Google Chrome, which originates when the program caches a TLS session before validating a certificate. An attacker can exploit the vulnerability to decrypt TLS sessions...

OpenSSL Cross-Protocol Attack Vulnerability

OpenSSL is a general-purpose open source cryptographic library that implements Secure Sockets Layer and Secure Transport Layer protocols and can support a variety of cryptographic algorithms, including symmetric ciphers, hashing algorithms, secure hashing algorithms, and so on. Cross-protocol...

openssl: Divide-and-conquer session key recovery in SSLv2

It was discovered that the SSLv2 servers using OpenSSL accepted SSLv2 connection handshakes that indicated non-zero clear key length for non-export cipher suites. An attacker could use this flaw to decrypt recorded SSLv2 sessions with the server by using it as a decryption oracle...

PT-2016-4396

Name of the Vulnerable Software and Affected Versions libssh versions prior to 0.7.3 Description The issue is related to a "bits/bytes confusion bug" in the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. This bug causes ephemeral secrets to be improperly truncated to 128...