CVE-2017-7574

Schneider Electric SoMachine Basic 1.4 SP1 and Modicon TM221CE16R 1.3.3.3 contain a hardcoded cryptographic key used to AES-CBC encrypt project files; the fixed key (SoMachineBasicSoMachineBasicSoMa) cannot be changed, allowing decrypted data to reveal the user password and enable opening/modifyi...

Schneider Hardcoded Password

OpenSource Security Ralf Spenneberg Am Bahnhof 3-5 48565 Steinfurt [email protected] OS-S Security Advisory 2017-02 Date: April 4th, 2017 Authors: Simon Heming, Maik BrA1/4ggemann, Hendrik Schwartke, Ralf Spenneberg CVE: not yet assigned CVSS: 10 Affected Device: Schneider SoMachine Basic 1.4 SP1,...

Broadcom Wi-Fi SoC - Heap Overflow in wlc_tdls_cal_mic_chk Due to Large RSN IE in TDLS Setup Confirm

Exploit for hardware platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1047 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are...

Broadcom Wi-Fi SoC - Heap Overflow wlc_tdls_cal_mic_chk Due to Large RSN IE in TDLS Setup Confirm Frame

Broadcom Wi-Fi SoC - Heap Overflow wlctdlscalmicchk Due to Large RSN IE in TDLS Setup Confirm Frame Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1047 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in bot...

nRF24 Playset - Software tools for Nordic Semiconductor nRF24-based Devices like Wireless Keyboards, Mice, and Presenters

The nRF24 Playset is a collection of software tools for wireless input devices like keyboards, mice, and presenters based on Nordic Semiconductor nRF24 transceivers, e.g. nRF24LE1 and nRF24LU1+. All software tools support USB dongles with the nrf-research-firmware by the Bastille Threat...

Microsoft Bulletin: detection and protection CVE-2017-0005 mention the right vulnerability-vulnerability warning-the black bar safety net

! 2017 3 October 14, Microsoft released a security Bulletin MS17-013, designed to address the CVE-2017-0005 mention the right vulnerability, Qualys vulnerability Labs Director, Amol Sarwate, said:“CVE-2017-0005 is a zero-day vulnerability issue currently being the abuse, the use of Silverlight as...

Oracle knowledge management system XXE vulnerability analysis: can lead to RCE-vulnerability warning-the black bar safety net

A vulnerability summary This article on the Oracle knowledge management system 8. 5. 1 announcements content analysis. Oracle's InQuira knowledge management products with the various sources of search technology, provides users with easy and convenient access to knowledge method, the knowledge of...

Phabricator: Phabricator is vulnerable to padding oracle attacks and chosen-ciphertext attacks.

Dear Phabricator bug bounty team, Summary --- Phabricator encrypts data with AES in CBC mode, but does not ensure integrity of the encrypted data. You must authenticate the data, by either using an HMAC or by using an authenticated block cipher mode like GCM. Why does this vulnerability exist? --...

About the security content of Pages 6.1, Numbers 4.1, and Keynote 7.1 for Mac and Pages 3.1, Numbers 3.1, and Keynote 3.1 for iOS - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

Oracle Knowledge Management XXE Leading to a RCE

Vulnerability Summary The following advisory describe Information Disclosure found in Oracle Knowledge Management version 8.5.1. By enabling searches across a wide variety of sources, Oracle’s InQuira knowledge management products offer simple and convenient ways for users to access knowledge tha...

Oracle Knowledge Management 12.1.1 < 12.2.5 - XML External Entity Leading To Remote Code Execution

SSD Advisory – Oracle Knowledge Management XXE Leading to a RCE Vulnerability Summary The following advisory describe Information Disclosure found in Oracle Knowledge Management version 8.5.1. By enabling searches across a wide variety of sources, Oracle's InQuira knowledge management products...

Stitch - Python Remote Administration Tool (RAT)

This is a cross platform python framework which allows you to build custom payloads for Windows, Mac OSX and Linux as well. You are able to select whether the payload binds to a specific IP and port, listens for a connection on a port, option to send an email of system info when the system boots,...

Design/Logic Flaw

An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographers. The fact that inc/SP/Core/Crypt.class is using the MCRYPTRIJNDAEL256 function the 256-bit block version of Rijndael, not AES instead of MCRYPTRIJNDAEL128 real AES could help...

CVE-2017-5999

An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographers. The fact that inc/SP/Core/Crypt.class is using the MCRYPTRIJNDAEL256 function the 256-bit block version of Rijndael, not AES instead of MCRYPTRIJNDAEL128 real AES could help...

AES - Critical - Unsupported - SA-CONTRIB-2017-027

This module provides an API that allows other modules to encrypt and decrypt data using the AES encryption algorithm. The module does not follow requirements for encrypting data safely. An attacker who gains access to data encrypted with this module could decrypt it more easily than should be...

sysPass >= 2.0 risky cryptographic algorithm usage Vulnerability

Exploit for php platform in category web applications CVE-2017-5999 - sysPass risky cryptographic algorithm usage Credit: Guenaelle De Julis & Quentin Olagne CVE: CVE-2017-5999 Dates: 14/02/2017 Vendor: sysPass Product: sysPass Versions Affected: = 2.0 Risk / Severity Rating: 4.4 CVSSv2 SysPass...

GLSA-201702-14 : PyCrypto: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-201702-14 PyCrypto: Remote execution of arbitrary code A heap-based buffer overflow vulnerability has been discovered in PyCrypto. Please review the CVE identifier referenced below for details. Impact : A remote attacker, able to...

PyCrypto: Remote execution of arbitrary code

Background The Python Cryptography Toolkit PyCrypto is a collection of both secure hash functions such as SHA256 and RIPEMD160, and various encryption algorithms AES, DES, RSA, ElGamal, etc.. Description A heap-based buffer overflow vulnerability has been discovered in PyCrypto. Please review the...

Python Remote Administration Tool: Stitch

Python Remote Administration Tool This is a cross platform python framework which allows you to build custom payloads for Windows, Mac OSX and Linux as well. You are able to select whether the payload binds to a specific IP and port, listens for a connection on a port, option to send an email of...

SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2017:0441-1)

This update for openssl fixes the following issues contained in the OpenSSL Security Advisory 26 Jan 2017 bsc1021641 Security issues fixed : - CVE-2016-7055: The x8664 optimized montgomery multiplication may produce incorrect results bsc1009528 - CVE-2017-3731: Truncated packet could crash via OO...