PT-2024-11147 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A memory leak issue has been resolved in the Linux kernel, specifically in the crypto: sun8i-ss module. The issue occurs when the dma iv mapping fails, causing the return error path to...

JFrog Artifactory < 6.23.1 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote machine is prior to 6.23.1. It is, therefore, affected by multiple vulnerabilities: - CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to...

GitHub Security Lab: [Java] CWE-327: Add more broken crypto algorithms

This bug was reported directly to GitHub Security Lab...

Unbreakable Enterprise kernel security update

5.4.17-2036.104.4.el8uek - KVM: arm64: guest context in x18 instead of x29 Mihai Carabas Orabug: 32545182 5.4.17-2036.104.3.el8uek - config: enable CONFIGMLX5MPFS Brian Maly Orabug: 32249042 - net: Fix bridge enslavement failure Ido Schimmel Orabug: 32503298 - inet: do not call sublistrcv on empt...

NewStart CGSL CORE 5.04 / MAIN 5.04 : freerdp Vulnerability (NS-SA-2021-0009)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has freerdp packages installed that are affected by a vulnerability: - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds OOB write vulnerability has been detected in cryptorsacommon in libfreerdp/crypto/crypto.c...

Dark Web Markets for Stolen Data See Banner Sales

Despite an explosion in the sheer amount of stolen data available on the Dark Web, the value of personal information is holding steady, according to the 2021 Dark Web price index from Privacy Affairs. That leaves these thriving dirty data dealers in a familiar predicament — they need to lock down...

Microsoft Exchange attacks cause panic as criminals go shell collecting

Only last week we posted a blog about multiple zero-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. Seeing how this disclosure came with a patch being available, under normal circumstances you would see some companies update...

PT-2021-8004 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a memory leak in the sun8i-ss crypto driver of the Linux kernel. This memory leak occurs on an error path and can be exploited by a remote attacker to cause a...

OSV-2021-494 Heap-buffer-overflow in AK::ByteBuffer::overwrite

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31698 Crash type: Heap-buffer-overflow READ 1 Crash state: AK::ByteBuffer::overwrite Crypto::PK::RSA::parsersakey FuzzRSAKeyParsing.cpp...

OESA-2021-1064 openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the...

Huawei EulerOS: Security Advisory for python-crypto (EulerOS-SA-2021-1513)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 3.0.6.6 : python-crypto (EulerOS-SA-2021-1513)

According to the version of the python-crypto package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to...

The vulnerability of the Go programming language, related to incorrect calculations, allows attackers to disclose protected information and compromise the integrity of that information.

The vulnerability in the crypto/elliptic/p224.go programming language is related to incorrect calculations. Exploiting this vulnerability can allow a remote attacker to disclose protected information and compromise the integrity of that information...

Cryptocurrency exchange in liquidation due to hack, hacked again

By Waqas Cryptopia cryptocurrency exchange was hacked in 2019 and put into liquidation after suffering a loss of USD 30 million in crypto-assets. This is a post from HackRead.com Read the original post: Cryptocurrency exchange in liquidation due to hack, hacked again...

Insecure JWT Signing

yapi-vendor does not perform secure JWT signing. The function randStr uses a cryptographically insecure pseudo-random number generator Math.random to create a randomly looking string that later is used to sign and verify issued tokens...

Botnet Abusing Bitcoin Blockchain To Evade Detection

By Deeba Ahmed Cybercriminals are abusing Bitcoin transactions to carry out illegal crypto mining operations while staying under the radar. This is a post from HackRead.com Read the original post: Botnet Abusing Bitcoin Blockchain To Evade Detection...

Nvidia's Anti-Cryptomining GPU Chip May Not Discourage Attacks

Nvidia, the chip company known for its gaming-friendly graphical processing units GPUs, said that its hotly anticipated GeForce RTX 3060 chipset, launching Thursday, has an added bonus of thwarting crypto-mining. Experts applaud the effort, but are skeptical the move will take the bullseye off th...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update

Red Hat OpenShift Container Platform release 4.7.0 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Huawei EulerOS: Security Advisory for python-crypto (EulerOS-SA-2021-1351)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP2 : python-crypto (EulerOS-SA-2021-1351)

According to the version of the python-crypto package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive...