Critical Bug in Siemens SIMATIC PLCs Could Let Attackers Steal Cryptographic Keys

A vulnerability in Siemens Simatic programmable logic controller PLC can be exploited to retrieve the hard-coded, global private cryptographic keys and seize control of the devices. "An attacker can use these keys to perform multiple advanced attacks against Siemens SIMATIC devices and the relate...

Xiaomi Phones with MediaTek Chips Found Vulnerable to Forged Payments

Security flaws have been identified in Xiaomi Redmi Note 9T and Redmi Note 11 models, which could be exploited to disable the mobile payment mechanism and even forge transactions via a rogue Android app installed on the devices. Check Point said it found the flaws in devices powered by MediaTek...

GSD-2022-1004952 Logging of sensitive information in Wallet version Current version and possibly previous versions

In Slope Wallet, the current version and possibly previous versions the logging of sensitive information including seed phrases exist in the wallet software. This can be attacked via access to the logging data which is reportedly sent in clear text across the Internet and the logging server...

CVE-2022-29960

Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for protection of certain system credentials, engineering files, and sensitive utilities...

Security Bulletin: IBM QRadar Network Security is affected by hard-coded credentials exploits.

Summary IBM QRadar Network Security has addressed the hard coded cryptographic keys in multiple places.ase id:462652, ase id:462653, ase id:462654 Vulnerability Details CVEID:CVE-2020-4157 DESCRIPTION: IBM QRadar Network Security contains hard-coded credentials, such as a password or cryptographi...

CVE-2022-29330

Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors...

CVE-2022-29330

Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors...

CVE-2022-29330

Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors...

Improper access control

Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors...

CVE-2022-29330

The CVE-2022-29330 entry concerns VitalPBX (pre-3.2.1) with a missing access control in the backup system. The underlying flaw allows unauthorized access to sensitive data, including PJSIP and SIP extension credentials, cryptographic keys, and voicemail files, via unspecified vectors. Evidence ac...

CVE-2022-29330

Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors...

PT-2022-19547 · Telesoft · Telesoft Vitalpbx

Name of the Vulnerable Software and Affected Versions: Telesoft VitalPBX versions prior to 3.2.1 Description: The issue concerns missing access control in the backup system, allowing attackers to access sensitive data such as PJSIP and SIP extension credentials, cryptographic keys, and voicemails...

Hertzbleed exposes computers’ secret whispers

Hertzbleed is the name for a vulnerability that can be used to obtain cryptographic keys and other secret data from Intel and AMD CPUs, remotely. It works by monitoring changes in power consumption, which can be deduced by the careful timing of known workloads, thanks to a processor power saving...

New Hertzbleed Side Channel Attack Affects All Modern AMD and Intel CPUs

A newly discovered security vulnerability in modern Intel and AMD processors could let remote attackers steal encryption keys via a power side channel attack. Dubbed Hertzbleed by a group of researchers from the University of Texas, the University of Illinois Urbana-Champaign, and the University ...

Missing Cryptographic Step in cassproject

Impact CaSS Library, npm:cassproject has a missing cryptographic step when storing cryptographic keys that can allow a server administrator access to an account’s cryptographic keys. This affects CaSS servers using standalone username/password authentication, which uses a method that expects e2e...

Authentication Bypass

cassproject is vulnerable to authentication bypass. A missing cryptographic step when storing cryptographic keys may allow an attacker to gain server administrator access to an account's cryptographic keys...

CVE-2022-29229

CaSS is a Competency and Skills System. CaSS Library, npm:cassproject has a missing cryptographic step when storing cryptographic keys that can allow a server administrator access to an account’s cryptographic keys. This affects CaSS servers using standalone username/password authentication, whic...

Authorization

CaSS is a Competency and Skills System. CaSS Library, npm:cassproject has a missing cryptographic step when storing cryptographic keys that can allow a server administrator access to an account’s cryptographic keys. This affects CaSS servers using standalone username/password authentication, whic...

CVE-2022-29229 Missing Cryptographic Step in cassproject

CaSS is a Competency and Skills System. CaSS Library, npm:cassproject has a missing cryptographic step when storing cryptographic keys that can allow a server administrator access to an account’s cryptographic keys. This affects CaSS servers using standalone username/password authentication, whic...

CVE-2022-29229

CaSS Library (npm:cassproject) has a missing cryptographic step when storing cryptographic keys, which can allow a server administrator to access an account’s keys. This affects CaSS servers using standalone username/password authentication, where credentials are assumed to be end-to-end secure. ...