4272 matches found
CVE-2025-56802
The Reolink desktop application (specifically version 8.18.12 ) is vulnerable to a cryptographic flaw where it uses hard-coded and predictable AES-CFB keys to protect user configuration files. An attacker with local access can navigate to the %APPDATA% directory to locate files such as .json. The...
CVE-2025-56802: Use of Hard-coded Cryptographic Key
The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access to decrypt sensitive application data stored in %APPDATA%. A different vulnerability than CVE-2025-56801. NOTE: the Supplier's position is...
PT-2025-42927
Name of the Vulnerable Software and Affected Versions Reolink desktop application affected versions not specified Description The Reolink desktop application employs a hard-coded and predictable AES encryption key for encrypting user configuration files. This allows attackers with local access to...
CVE-2025-56801: Use of Hard-coded Cryptographic Key
The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector IV in its AES-CFB encryption implementation allowing attackers with access to the application environment to reliably decrypt encrypted configuration data. NOTE: the Supplier's position is that...
CVE-2025-56802
The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access to decrypt sensitive application data stored in %APPDATA%. A different vulnerability than CVE-2025-56801. NOTE: the Supplier's position is...
PT-2025-42926
Name of the Vulnerable Software and Affected Versions Reolink Desktop Application version 8.18.12 Description The Reolink Desktop Application version 8.18.12 contains hardcoded credentials used as the Initialization Vector IV in its AES-CFB encryption implementation. This allows attackers with...
EUVD-2025-35218
The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access to decrypt sensitive application data stored in %APPDATA%. A different vulnerability than CVE-2025-56802...
CVE-2025-56802
The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access to decrypt sensitive application data stored in %APPDATA%. A different vulnerability than CVE-2025-56801. NOTE: the Supplier's position is...
CVE-2025-55039
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true it is set to false by default, but...
Apache Spark has Inadequate Encryption Strength
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true it is set to false by default, but...
Improper Verification of Cryptographic Signature
Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature when the spark.network.crypto.enabled is true and the cipher is not explicitly configured, resulting in the use of AES in CTR mode without authentication. An attacker can compromise the...
CVE-2025-55039 Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true it is set to false by default, but...
PT-2025-42275
Name of the Vulnerable Software and Affected Versions Apache Spark versions prior to 3.4.4 Apache Spark versions prior to 3.5.2 Apache Spark versions prior to 4.0.0 Description Apache Spark versions before 3.4.4, 3.5.2, and 4.0.0 utilize an insecure default network encryption cipher for RPC...
CVE-2025-55039: Improper Verification of Cryptographic Signature
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true it is set to false by default, but...
Linux Distros Unpatched Vulnerability : CVE-2023-53599
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: crypto: afalg - Fix missing initialisation affecting gcm-aes-s390 Fix afalgallocareq to...
MAL-2025-47979 Malicious code in jito-sub-aes-ipheriv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 103b0ca3b2a6d09bab1b2b0a19d08540d01dfbfe07e7eba218427c25239cfbc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in jito-sub-aes-ipheriv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 103b0ca3b2a6d09bab1b2b0a19d08540d01dfbfe07e7eba218427c25239cfbc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in aes-create-ipheriv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32024f762cae5f727853e7d6e07ee5012a1b440d859182a62be6123eb638e873 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...