7330 matches found
Authentication flaw
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass...
CVE-2020-26511
The CVE-2020-26511 entry concerns the WordPress plugin wpo365-login prior to v11.7. The issue is that the plugin uses a symmetric algorithm to decrypt a JWT token, enabling authentication bypass. Concrete details from connected sources specify the affected product (WordPress plugin wpo365-login),...
CVE-2020-26511
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass...
CVE-2020-26511: Improper Authentication
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass...
PT-2020-16432
Name of the Vulnerable Software and Affected Versions wpo365-login plugin versions prior to 11.7 Description The issue allows for authentication bypass due to the use of a symmetric algorithm to decrypt a JWT token. Recommendations For versions prior to 11.7, update to version 11.7 or later to...
CVE-2020-9491: Use of a Broken or Risky Cryptographic Algorithm
In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced...
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
...
CVE-2020-11031
CVE-2020-11031 affects GLPI prior to 9.5.0 where the encryption algorithm is insecure and data security relies on user-chosen password strength. An attacker could decrypt data if a weak/predictable password is used. The issue is addressed in GLPI 9.5.0 by switching to a more secure library (sodiu...
CVE-2020-11031: Use of a Broken or Risky Cryptographic Algorithm
In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The librar...
IBM Data Risk Manager weak encryption algorithm vulnerability (CNVD-2020-53514)
IBM Data Risk Manager is a data risk manager that helps discover, analyze and visualize business risks associated with data. A weak cryptographic algorithm vulnerability exists in IBM Data Risk Manager 2.0.6. An attacker could exploit the vulnerability to decrypt highly sensitive information...
CVE-2020-4613: Use of a Broken or Risky Cryptographic Algorithm
IBM Data Risk Manager iDNA 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 184925...
Information Disclosure
firefox is vulnerable to information disclosure. The vulnerability exists as an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POINTATINFINITY" when it should not...
Certificate Signature Forging
gnupg2 allows forging of certificate signature. Certificate signatures can be forged using collisions found in the SHA-1 algorithm. An attacker is able to exploit the vulnerability to create forged certificate signatures...
Philips Clinical Collaboration Platform Algorithm Degradation Vulnerability
Philips Clinical Collaboration Platform is an HMI data management platform. An algorithm degradation vulnerability exists in Philips Clinical Collaboration Platform version 12.2.1 and earlier. The vulnerability stems from the software failing to properly control the allocation and maintenance of...
USN-4516-1 gnupg2 vulnerability
It was discovered that GnuPG signatures could be forged when the SHA-1 algorithm is being used. This update removes validating signatures based on SHA-1 that were generated after 2019-01-19. In environments where this is still required, a new option --allow-weak-key-signatures can be used to reve...
USN-4516-1: GnuPG vulnerability
It was discovered that GnuPG signatures could be forged when the SHA-1 algorithm is being used. This update removes validating signatures based on SHA-1 that were generated after 2019-01-19. In environments where this is still required, a new option --allow-weak-key-signatures can be used to reve...
CVE-2020-25728
The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm involving an increment that allows a malicious user to change any user's account password include the admin account...
CVE-2020-25728
The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm involving an increment that allows a malicious user to change any user's account password include the admin account...
Default credentials
The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm involving an increment that allows a malicious user to change any user's account password include the admin account...