Nitrokey 3 Firmware 授权问题漏洞

Nitrokey 3 Firmware is a Nitrokey 3 firmware from Nitrokey Open Source. Nitrokey 3 Firmware suffers from an authorization issue vulnerability that stems from the fact that a PIV application can accept an invalid key to validate an administrative key. This could result in the integrity of data...

DeltaPrime Suffers $5.98M Loss as Hacker Exploits Admin Key on Arbitrum

The attack is ongoing...

CVE-2024-1258

A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file api/config/params.php of the component API. The manipulation of the argument JWTKEYADMIN leads to use of hard-coded cryptographic k...

Vulnerability fixed in IBM QRadar SIEM

A vulnerability has been fixed in IBM QRadar SIEM. QRadar SIEM copies certificate files used for SSL/TLS in the QRadar Web interface to hosts in the implementation that do not need the key. Misuse of this can lead to possible access to the admin web server key. IBM has released updates to fix the...

Authentication Bypass

minio is vulnerable to authentication bypass. An attacker can create new service accounts using existing access keys without knowing the secret admin key...

Tokens are directly transferred from briber to BribeVault

Lines of code Vulnerability details Impact Function depositBribeERC20 in BribeVault transfers tokens directly from the briber: // Since this method is called by a depositor contract, we must transfer from the account // that called the depositor contract - amount must be approved beforehand...

CVE-2020-13963

SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for admin is hardcoded in the installation code, and there is no key for publicsp which is a guest account...

Hardcoded credentials

SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for admin is hardcoded in the installation code, and there is no key for publicsp which is a guest account...

PT-2021-9684 · Unknown · Soplanning

Name of the Vulnerable Software and Affected Versions: SOPlanning versions prior to 1.47 Description: The issue is related to incorrect access control due to public secret key information and its related authentication algorithm. Specifically, the key for the admin account is hardcoded in the...

PicketBox: Insecure storage of masked passwords

PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file...

cups: privilege escalation for users of the CUPS SystemGroup group

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface...

DEBIAN-CVE-2012-5519

CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface...