CVE-2023-37857: Use of Hard-coded Credentials

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created by the attacker are not sufficient to...

PT-2023-4515 · Phoenix Contact · Phoenix Contact Wp 6Xxx Series Web Panels

Name of the Vulnerable Software and Affected Versions: PHOENIX CONTACT WP 6xxx series web panels versions prior to 4.0.10 Description: The issue is related to the use of hardcoded credentials in PHOENIX CONTACT WP 6xxx series web panels. An authenticated, remote attacker with admin privileges can...

CVE-2023-3817 Excessive time spent checking DH q parameter value

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System (GMS) global network firewall management system lies in the use of cryptographic algorithms with hard-programmed keys for encryption. This allows attackers to compromise the integrity of the protected information.

The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System’s global network gateways is related to the use of cryptographic algorithms for encryption with a hard-programmed key. Exploiting this vulnerability could allow an attacker, operating...

Milesight MilesightVPN requestHandlers.js verifyToken authentication bypass vulnerability

Talos Vulnerability Report TALOS-2023-1700 Milesight MilesightVPN requestHandlers.js verifyToken authentication bypass vulnerability July 6, 2023 CVE Number CVE-2023-22844 SUMMARY An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN...

Secrets, Secrets Are No Fun. Secrets, Secrets (Stored in Plain Text Files) Hurt Someone

Secrets are meant to be hidden or, at the very least, only known to a specific and limited set of individuals or systems. Otherwise, they aren't really secrets. In personal life, a secret revealed can damage relationships, lead to social stigma, or, at the very least, be embarrassing. In a...

Researchers Find Way to Recover Cryptographic Keys by Analyzing LED Flickers

In what's an ingenious side-channel attack, a group of academics has found that it's possible to recover secret keys from a device by analyzing video footage of its power LED. "Cryptographic computations performed by the CPU change the power consumption of the device which affects the brightness ...

CVE-2023-32549

Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator...

CVE-2023-32549

Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator...

Code injection

Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator...

CVE-2023-32549 Landscape insecure token generation

Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator...

CVE-2023-32549

CVE-2023-32549 affects Canonical Landscape where cryptographic keys are generated using a weak pseudo-random generator. The flaw enables potential confidentiality exposure (CVE with network attack vector, no user interaction; CVSS 3.1 base score 7.5). Root cause: insecure PRNG-based key generatio...

CVE-2023-32549 Landscape insecure token generation

Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator...

PT-2023-23870

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue involves the insecure generation of landscape cryptographic keys due to the use of a weak pseudo-random generator. Recommendations At the moment, there is no information abo...

CVE-2023-32549: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator...

CVE-2023-20107

A vulnerability in the deterministic random bit generator DRBG, also known as pseudorandom number generator PRNG, in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an...

Design/Logic Flaw

A vulnerability in the deterministic random bit generator DRBG, also known as pseudorandom number generator PRNG, in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an...

CVE-2023-20107 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability

A vulnerability in the deterministic random bit generator DRBG, also known as pseudorandom number generator PRNG, in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an...

PT-2023-2257 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software versions prior to the fixed version Cisco Firepower Threat Defense FTD Software versions prior to the fixed version Description: The issue is related to the deterministic random bit generator DRB...

Two New Vulnerabilities Discovered in TPM 2.0 Library

Threat Level Vulnerability Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary The Trusted Platform Module TPM 2.0 specification, a hardware-based technology used to provide tamper-resistant secure cryptographic functions, is affected by...