Cisco Meraki Z and Cisco Meraki MX buffer error vulnerabilities

The Cisco Meraki Z and Cisco Meraki MX are both products of Cisco, Inc.The Cisco Meraki Z is an enterprise-class firewall, VPN gateway, and router.The Cisco Meraki MX is a multifunction security and SD-WAN enterprise appliance. A buffer error vulnerability exists in the Cisco Meraki Z and Cisco...

Cisco AnyConnect VPN resource management error vulnerability

Cisco AnyConnect VPN is a virtual private network VPN client from Cisco that supports remote users connecting to corporate networks via SSL VPN and IPSec VPN. Cisco AnyConnect VPN suffers from a Resource Management Error vulnerability that stems from a weak entropy value of the handler used in th...

CVE-2024-20509: Concurrent Execution using Shared Resource with Improper Synchronization

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service DoS condition for individual users of the AnyConnect VPN...

Cisco AnyConnect VPN security vulnerabilities

Cisco AnyConnect VPN is a virtual private network VPN client from Cisco that supports remote users connecting to corporate networks via SSL VPN and IPSec VPN. Cisco AnyConnect VPN suffers from a security vulnerability that stems from a weak entropy value of the handler used in the VPN...

Cisco AnyConnect VPN buffer error vulnerability

Cisco AnyConnect VPN is a virtual private network VPN client from Cisco that supports remote users connecting to corporate networks via SSL VPN and IPSec VPN. Cisco AnyConnect VPN suffers from a buffer error vulnerability that stems from a weak entropy value of the handler used in the VPN...

Cisco AnyConnect VPN competitive conditions vulnerability

Cisco AnyConnect VPN is a virtual private network VPN client from Cisco that supports remote users connecting to corporate networks via SSL VPN and IPSec VPN. Cisco AnyConnect VPN suffers from a Competitive Condition Issue vulnerability that stems from a weak entropy value of the handler used in...

PT-2024-40179

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to the fixed version Description: The issue concerns the generation of CAPTCHA challenges. Specifically, the Zend Captcha Word v1 and ZendCaptchaWord v2 components use PHP's internal array rand function to select...

PT-2024-40024

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to the fixed version Description The issue is related to the generation of CAPTCHA challenges. Specifically, the Zend Captcha Word v1 and ZendCaptchaWord v2 components use PHP's internal array rand function to...

RHEL 6 : libxdmcp (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - libXdmcp: weak entropy usage for session keys CVE-2017-2625 Note that Nessus has not tested for this issue but has...

RHEL 5 : libxdmcp (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - libXdmcp: weak entropy usage for session keys CVE-2017-2625 Note that Nessus has not tested for this issue but has...

Weak Entropy In Token Generation

friendsofsymfony/user-bundle is vulnerable to Weak Entropy in Token Generation. The vulnerability is due to the imprecise nature of the baseconvert function used in FOSUserBundle, which allows attackers to exploit the weakened randomness of tokens generated for email confirmation and password...

jose4j: Insecure iteration count setting

A flaw was found in Jose4J which allows a malicious user or internal person to erroneously set a low iteration count of 1000 or less to secure the Json Web Token. This could apply to lack of entropy and leave the system less secure...

CVE-2023-39910

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet...

CVE-2023-39910

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet...

VulnCheck KEV: CVE-2023-39910

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet...

PT-2023-5500

Name of the Vulnerable Software and Affected Versions Libbitcoin Explorer versions 3.0.0 through 3.6.0 Description The issue is related to the use of a weak cryptocurrency wallet entropy seeding mechanism in Libbitcoin Explorer, also known as the Milk Sad issue. This weakness allows remote...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

Security Bulletin: Vulnerability in xorg-x11-libXdmcp affects IBM BladeCenter Advanced Management Module (AMM)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerability in xorg-x11-libXdmcp. Vulnerability Details Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerability in xorg-x11-libXdmcp. Vulnerability Details CVEID:...

Cisco DRBG Secret Key Disclosure

The vulnerability of the Deterministic Random Bit Generator DRBG, a microprogramming-based software component used in Cisco Adaptive Security Appliances and Cisco Firepower Threat Defense, relates to the use of a weak entropy source during the generation of cryptographic keys. Exploiting this...

SUSE CVE-2013-2872

Google Chrome before 28.0.1500.71 on Mac OS X does not ensure a sufficient source of entropy for renderer processes, which might make it easier for remote attackers to defeat cryptographic protection mechanisms in third-party components via unspecified vectors...