CVE-2008-7311

The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.actioncontrollersession hash value aka secret key, which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the...

CVE-2013-5391: Undefined Security Weakness

IBM Worklight Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.x before 6.0.0 Fix Pack 2, and Mobile Foundation Consumer and Enterprise Editions 5.0.x before 5.0.6 Fix Pack 2 and 6.0.0 Fix Pack 2 make it easier for attackers to defeat cryptographic protection mechanisms by...

Infineon RSA Library Cryptographic Security Bypass Vulnerability

The Infineon Trusted Platform Module TPM is a data encryption chip from Infineon Technologies, Germany.The Infineon RSA library is one of the encryption libraries. A security vulnerability exists in the Infineon RSA library version 1.02.013 of the Infineon TPM, which does not properly handle RSA...

CVE-2017-14422: Use of Hard-coded Credentials

D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 and REV. B with firmware through FW208WWb02 devices use the same hardcoded /etc/stunnel.key private key across different customers' installations, which allows remote attackers to defeat the HTTPS cryptographic protection mechanisms...

CVE-2016-4693: Inadequate Encryption Strength

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "Security" component, which makes it easier for attackers to bypass cryptographic protection mechanisms by leveraging use of t...

CVE-2016-2364: Undefined Security Weakness

The Chrome HUDweb plugin before 2016-05-05 for Fonality previously trixbox Pro 12.6 through 14.1i uses the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from...

CVE-2016-1938: Undefined Security Weakness

The smpdiv function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services NSS before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the 1 mpdiv or 2...

HP Version Control Repository Manager < 7.5.0 Multiple Vulnerabilities (HPSBMU03396) (FREAK)

The version of HP Version Control Repository Manager VCRM installed on the remote Windows host is prior to 7.5.0. It is, therefore, affected by multiple vulnerabilities : - A NULL pointer dereference flaw exists when the SSLv3 option isn't enabled and an SSLv3 ClientHello is received. This allows...

CVE-2015-3960: Undefined Security Weakness

The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by...

CVE-2015-4259: Undefined Security Weakness

The Integrated Management Controller on Cisco Unified Computing System UCS C servers with software 1.53 and 1.60.16 has a default SSL certificate, which makes it easier for man-in-the-middle attackers to bypass cryptographic protection mechanisms by leveraging knowledge of a private key, aka Bug...

CVE-2014-6229: Exposure of Sensitive Information to an Unauthorized Actor

The HashContext class in hphp/runtime/ext/exthash.cpp in Facebook HipHop Virtual Machine HHVM before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string,...

Mozilla Thunderbird < 24.3 Multiple Vulnerabilities

The installed version of Thunderbird is earlier than 24.3 and is, therefore, potentially affected the following vulnerabilities: - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. CVE-2014-1477 - An error exists related to System Only...

CVE-2013-5960: Undefined Security Weakness

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API ESAPI for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic...