7328 matches found
ROSA KOBALT SSH Weak Encryption
The vulnerability of the SSH server on the ROS KOBALT operating system is related to the use of weak encryption algorithms such as RC4 and Blowfish. Exploiting this vulnerability allows a remote attacker to circumvent the cryptographic security measures...
Apple’s NeuralHash Algorithm Has Been Reverse-Engineered
Apples NeuralHash algorithm -- the one its using for client-side scanning on the iPhone -- has been reverse-engineered. Turns out it was already in iOS 14.3, and someone noticed: Early tests show that it can tolerate image resizing and compression, but not cropping or rotations. We also have the...
Detecting Embedded Content in OOXML Documents
On Advanced Practices, we are always looking for new ways to find malicious activity and track adversaries over time. Today we’re sharing a technique we use to detect and cluster Microsoft Office documents—specifically those in the Office Open XML OOXML file format. Additionally, we’re releasing ...
Broken User Authentication☝️ — What you need to know
Broken User Authentication☝️ — What you need to know Introduction API2:Broken User Authentication What is Broken User Authentication? Broken User Authentication can manifest in several issues. Whenever we come across an API endpoint that handles authentication we need to be extra careful since...
Revive Adserver: Use of a Broken or Risky Cryptographic Algorithm
revive-adserver utilizes a PRNG for session-token generation, this means that an attacker could theoretically be able to generate session tokens at random and take over accounts at random. This function does not generate cryptographically secure values, and should not be used for cryptographic...
[SECURITY] Fedora 34 Update: rust-unicode-linebreak-0.1.1-2.fc34
Implementation of the Unicode Line Breaking Algorithm...
[SECURITY] Fedora 34 Update: rust-unicode-truncate-0.2.0-2.fc34
Unicode-aware algorithm to pad or truncate str in terms of displayed width...
Fedora: Security Advisory for rust-unicode-truncate (FEDORA-2021-3cf88e44b4)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for rust-unicode-linebreak (FEDORA-2021-3cf88e44b4)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
OESA-2021-1309 gradle security update
Gradle is build automation evolved. Gradle can automate the building, testing, publishing, deployment and more of software packages or other types of projects such as generated static websites, generated documentation or indeed anything else. Gradle combines the power and flexibility of Ant with...
Amazon AWS CloudFront encryption vulnerability
Amazon AWS CloudFront is a content delivery network that provides basic services from Amazon.com, Inc.'s Web Services system. A security vulnerability exists in Amazon AWS CloudFront TLSv1.2 2019, where a related component uses a weak cryptographic algorithm resulting in a security risk...
Insecure Random Number Generation
yiisoft/yii2 is using insecure random number generation. The vulnerability exists because it uses the function mtrand in CaptchaAction.php which is a predictable Random Number algorithm for random bytes and int generation...
Insecure Random Number Generation
yiisoft/yii2 is using insecure random number generation. The vulnerability exists because it uses the function mtrand in BaseMailer.php which is a predictable Random Number algorithm for random bytes and int generation...
CVE-2019-25052: Use of a Broken or Risky Cryptographic Algorithm
In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information...
CVE-2021-3692
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator...
CVE-2021-3692
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator...
Code injection
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator...
CVE-2021-3692 Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator...
CVE-2021-3692
CVE-2021-3692 affects yiisoft/yii2 (and related versions) with a vulnerability described as Use of Predictable Algorithm in Random Number Generator. Public sources consistently point to insecure RNG usage, notably the use of mt_rand() in code paths such as CaptchaAction.php, leading to predictabl...
