Design/Logic Flaw

A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV initialization vector when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the calle...

CVE-2021-3446

A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV initialization vector when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the calle...

CVE-2021-3446

A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV initialization vector when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the calle...

PT-2021-5455 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 12.1.0.2, 12.2.0.1 and 19c Description: The issue is related to the Advanced Networking Option component of Oracle Database Server, allowing an unauthenticated attacker with network access via Oracle Net to...

Military Cryptanalytics, Part III

The NSA has just declassified and released a redacted version of Military Cryptanalytics, Part III, by Lambros D. Callimahos, October 1977. Parts I and II, by Lambros D. Callimahos and William F. Friedman, were released decades ago -- I believe repeatedly, in increasingly unredacted form -- and...

CVE-2020-14254

TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it...

CVE-2020-14254

TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it...

Code injection

TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it...

CVE-2020-14254

TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it...

CVE-2020-28396

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V16, SICAM A8000 CP-8021 All versions V16, SICAM A8000 CP-8022 All versions V16. A web server misconfiguration of the affected device can cause insecure ciphers usage by a user´s browser. An attacker in a privileged position...

CVE-2020-28396

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V16, SICAM A8000 CP-8021 All versions V16, SICAM A8000 CP-8022 All versions V16. A web server misconfiguration of the affected device can cause insecure ciphers usage by a user´s browser. An attacker in a privileged position...

Information disclosure

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V16, SICAM A8000 CP-8021 All versions V16, SICAM A8000 CP-8022 All versions V16. A web server misconfiguration of the affected device can cause insecure ciphers usage by a user´s browser. An attacker in a privileged position...

CVE-2020-28396

The CVE-2020-28396 entry affects Siemens SICAM A8000 RTUs (CP-8000, CP-8021, CP-8022) with all versions before V16. Root cause: a web server misconfiguration that enables insecure ciphers in the user’s browser, allowing an attacker in a privileged position to decrypt traffic and compromise confid...

CVE-2020-28396

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V16, SICAM A8000 CP-8021 All versions V16, SICAM A8000 CP-8022 All versions V16. A web server misconfiguration of the affected device can cause insecure ciphers usage by a user´s browser. An attacker in a privileged position...

Siemens SICAM A8000 RTUs

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SICAM A8000 Remote Terminal Unit Series Vulnerability: Protection Mechanism Failure 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

PT-2020-5606 · Siemens · Sicam A8000 Cp-8000 +2

Name of the Vulnerable Software and Affected Versions: SICAM A8000 CP-8000 versions prior to V16 SICAM A8000 CP-8021 versions prior to V16 SICAM A8000 CP-8022 versions prior to V16 Description: A web server misconfiguration in the affected devices can cause insecure ciphers usage by a user's...

Unintended Cipher

modns is vulnerable to unintended cipher attack. This vulnerability allows attackers to force the use of ciphers that were not intended to be enabled...

Security Bulletin: IBM Spectrum Protect Server allows Triple DES (3DES) ciphers to be used (CVE-2018-1785)

Summary IBM Spectrum Protect Server allows Triple DES 3DES ciphers to be used. This can result in the use of weaker than expected cryptographic algorithms. Vulnerability Details CVEID: CVE-2018-1785 DESCRIPTION: IBM Tivoli Storage Manager IBM Spectrum Protect 7.1 and 8.1 uses weaker than expected...

CVE-2020-8897

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM and other AEAD ciphers such as AES-GCM-SIV or XChaCha20Poly1305 used by the SDKs to encrypt messages, an attacker can craft a...

Design/Logic Flaw

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM and other AEAD ciphers such as AES-GCM-SIV or XChaCha20Poly1305 used by the SDKs to encrypt messages, an attacker can craft a...