CVE-2015-20112: Missing Cryptographic Step

RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network...

Security Bulletin: IBM Storage Ceph is vulnerable to Use of a Broken or Risky Cryptographic Algorithm in the RHEL UBI (CVE-2024-28834)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2024-28834 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2024-28834 DESCRIPTION: GnuTLS could allow a remote authenticated attacker to obtain...

CVE-2025-6521

CVE-2025-6521 affects the TrendMakers Sight Bulb Pro. During initial setup, AES keys are passed in cleartext as the device negotiates with an access point, enabling an attacker on an adjacent network to decrypt management app communications and potentially access credentials. The CISA ICS advisor...

CVE-2025-6521 TrendMakers Sight Bulb Pro Use of a Broken or Risky Cryptographic Algorithm

During the initial setup of the device the user connects to an access point broadcast by the Sight Bulb Pro. During the negotiation, AES Encryption keys are passed in cleartext. If captured, an attacker may be able to decrypt communications between the management app and the Sight Bulb Pro which...

USN-7594-2 linux-azure vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - PowerPC architecture; - RISC-V architecture; - User-Mode Linux UML; - x...

CVE-2025-6669

The CVE-2025-6669 entry concerns gooaclok819 sublinkX (versions up to 1.8). The root cause is in the code path middlewares/jwt.go where the input (sublink) manipulation leads to using a hard-coded cryptographic key, enabling remote exploitation. Public-admitted exploit maturity is noted (PoC). Re...

CVE-2025-6669

A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file middlewares/jwt.go. The manipulation with the input sublink leads to use of hard-coded cryptographic key . The attack can be initiated remotely. Th...

Signature Spoofing

pbkdf2 is vulnerable to Signature Spoofing. The vulnerability is due to improper input validation in the lib/to-buffer.js file, which allows an attacker to bypass signature verification and spoof cryptographic signatures, making malicious data appear authentic...

CVE-2025-6669: Use of Hard-coded Cryptographic Key

A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file middlewares/jwt.go. The manipulation with the input sublink leads to use of hard-coded cryptographic key . The attack can be initiated remotely. Th...

USN-7594-1 linux, linux-gcp, linux-raspi, linux-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - PowerPC architecture; - RISC-V architecture; - User-Mode Linux UML; - x...

CVE-2025-32977: Improper Verification of Cryptographic Signature

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 allows unauthenticated users to upload backup files to the system. While signature validation is implemented,...

sa2ul driver Cryptographic accelerator

Vulnerability of the sarun function in the drivers/crypto/sa2ul.c module – The driver for the Linux kernel cryptographic accelerator is vulnerable to a vulnerability where memory is not properly freed before removing the last reference to memory memory leak. Exploiting this vulnerability could...

adf_probe Heap Buffer Overflow DoS

Vulnerability of the adfprobe function in the drivers/crypto/qat/qatc3xxxvf/adfdrv.c module – The driver for the Linux kernel’s cryptographic accelerator involves the use of an uninitialized resource. Exploiting this vulnerability could allow a hacker to cause system failures...

drivers/crypto/intel/iaa/iaa_crypto_main.c Use After Free

Vulnerability of the saveiaawq function in the drivers/crypto/intel/iaa/iaacryptomain.c module – The Linux kernel cryptographic accelerator driver has a vulnerability related to insufficient validation of input data when dividing by zero. Exploiting this vulnerability could allow an attacker to...

sun8i_ss_prng_generate Heap Buffer Overflow DoS

Vulnerability of the sun8issprngGenerate function in the drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c module – The driver for the Linux operating system’s cryptographic acceleration engine is vulnerable due to the absence of restrictions and controls on resource distribution. Exploiting this...

Secure User-Friendly Blockchain Modular Wallet Design Using Android and OP-TEE

Emerging crypto economies still hemorrhage digital assets because legacy wallets leak private keys at almost every layer of the software stack, from user-space libraries to kernel memory dumps. This paper solves that twin crisis of security and interoperability by re-imagining key management as a...

On Immutable Memory Systems for Artificial Agents: a Blockchain-Indexed Automata-Theoretic Framework Using ECDH-Keyed Merkle Chains

This paper presents a formalized architecture for synthetic agents designed to retain immutable memory, verifiable reasoning, and constrained epistemic growth. Traditional AI systems rely on mutable, opaque statistical models prone to epistemic drift and historical revisionism. In contrast, we...

MECHA: Multithreaded and Efficient Cryptographic Hardware Access

This paper presents a multithread and efficient cryptographic hardware access MECHA for efficient and fast cryptographic operations that eliminates the need for context switching. Utilizing a UNIX domain socket, MECHA manages multiple requests from multiple applications simultaneously, resulting ...

Quantum Enhanced Entropy Pool for Cryptographic Applications and Proofs

This paper investigates the integration of quantum randomness into Verifiable Random Functions VRFs using the Ed25519 elliptic curve to strengthen cryptographic security. By replacing traditional pseudorandom number generators with quantum entropy sources, we assess the impact on key security and...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature. An attacker can bypass signature validation by introducing a timestamp response signature that chains to a trusted root, allowing acceptance of forged timestamp responses. Remediation...