CVE-2024-45165

An issue was discovered in UCI IDOL 2 aka uciIDOL or IDOL2 through 2.12. Data is sent between client and server with encryption. However, the key is derived from the string "c2007 UCI Software GmbH B.Boll" without quotes. The key is both static and hardcoded. With access to messages, this results...

CVE-2024-45165

An issue was discovered in UCI IDOL 2 aka uciIDOL or IDOL2 through 2.12. Data is sent between client and server with encryption. However, the key is derived from the string "c2007 UCI Software GmbH B.Boll" without quotes. The key is both static and hardcoded. With access to messages, this results...

UCI IDOL 2 安全漏洞

UCI IDOL 2 IDOL2,uciIDOL is a management system from UCI Inc. to optimize the company's business processes as well as increase productivity. A security vulnerability exists in UCI IDOL 2 version 2.12 and prior versions that stems from data being sent between a client and server using encryption,...

PT-2024-31448 · Uci Software Gmbh · Uci Idol 2

Name of the Vulnerable Software and Affected Versions: UCI IDOL 2 versions through 2.12 Description: An issue was discovered in the encryption mechanism used by UCI IDOL 2. Data sent between the client and server is encrypted, but the key is derived from a static string "c2007 UCI Software GmbH...

CVE-2024-36496

The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The application hashes this five-character password with the outdated and broken MD5 algorithm no salt and uses the first five bytes as the key for RC...

CVE-2024-36496

CVE-2024-36496 affects Faronics WINSelect (Standard + Enterprise) with vulnerable configurations prior to 8.30.xx.903. The issue arises from encrypting the configuration file using a static key derived from a static five-character password. That password is hashed with MD5 (no salt), and the firs...

Faronics WINSelect Trust Management Issues Vulnerability

Faronics WINSelect is an application from Faronics, Inc. It is used to customize the usage configuration of Windows computers. A security vulnerability previously existed in Faronics WINSelect version 8.30.xx.903, which arose from the use of configuration files encrypted with a static key derived...

CVE-2024-26841 LoongArch: Update cpu_sibling_map when disabling nonboot CPUs

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Update cpusiblingmap when disabling nonboot CPUs Update cpusiblingmap when disabling nonboot CPUs by defining & calling clearcpusiblingmap, otherwise we get such errors on SMT systems: jump label: negative count!...

CVE-2024-22734

An issue was discovered in AMCS Group Trux Waste Management Software before version 7.19.0018.26912, allows local attackers to obtain sensitive information via a static, hard-coded AES Key-IV pair in the TxUtilities.dll and TruxUser.cfg components...

CVE-2023-6482

Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor and send restricted commands to the fingerprint sensor. This may allow an attacker, who has physical access to the sensor, to enroll a...

CVE-2023-49256

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...

Authorization

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...

CVE-2023-49256 Predictable encryption passphrase used in publicly accessible configuration file

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...

CVE-2023-49256 Predictable encryption passphrase used in publicly accessible configuration file

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...

CVE-2023-49256

CVE-2023-49256 allows unauthenticated retrieval of a device’s configuration backup and decryption of passwords, using a hardcoded static key. Red Hat’s linked entries reiterate the issue and describe the root cause as hardcoded credentials embedded in the device, enabling confidentiality impact (...

The vulnerability of the FortiWAN traffic balancing system, related to deficiencies in authentication procedures, allows attackers to increase their privileges.

The vulnerability of the FortiWAN traffic balancing system is related to deficiencies in authentication procedures due to the use of a static key during the processing of JWT tokens. Exploiting this vulnerability allows an attacker to enhance their privileges by sending specially crafted HTTP and...

VulnCheck KEV: CVE-2023-5074

Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28...

PT-2023-7756 · Fortinet · Fortiwan

Name of the Vulnerable Software and Affected Versions: FortiWAN versions 5.1.1 through 5.1.2 FortiWAN versions 5.2.0 through 5.2.1 Description: The issue is related to improper authentication in FortiWAN, stemming from the use of a static key when handling JWT tokens. This can be exploited by a...

CVE-2023-27795

An issue found in IXP Data Easy Install v.6.6.14884.0 allows a local attacker to gain privileges via a static XOR key...

The vulnerability of the D-View 8 network device management platform, which stems from the use of rigidly encrypted user credentials, allows a malicious actor to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the D-View 8 network device management platform lies in the use of a static key during the processing of JWT tokens. Exploiting this vulnerability allows an attacker to bypass security restrictions and gain unauthorized access to protected information...