CVE-2023-31579

The CVE-2023-31579 issue affects Dromara Lamp-Cloud prior to v3.8.1, where a hardcoded cryptographic key is used when creating and verifying JSON Web Tokens. This root cause enables attackers to authenticate to the application via specially crafted JWT tokens, as documented across multiple source...

Medium: opensc

Issue Overview: Potential PIN bypass. When the token/card was plugged into the computer and authenticated from one process, it could be used to provide cryptographic operations from different process when the empty, zero-length PIN and the token can track the login status using some of its...

openshift: OCP & FIPS mode

A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2023-3058)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

NATS Server Security Vulnerability

NATS Server is an open source messaging system. The system is primarily used for cloud-native applications, IoT messaging, and microservice architectures. A security vulnerability exists in NATS Server versions 2.10.0 through 2.10.3, and nkeys versions 0.4.0 through 0.4.5, which stems from the...

[SECURITY] [DLA 3634-1] nss security update

Debian LTS Advisory DLA-3634-1 [email protected] https://www.debian.org/lts/security/ Sean Whitton October 28, 2023 https://wiki.debian.org/LTS Package : nss Version : 2:3.42.1-1+deb10u7 CVE ID : CVE-2020-25648 CVE-2023-4421 Multiple vulnerabilities were found in nss, a set of libraries...

Fedora: Security Advisory for mbedtls (FEDORA-2023-e0ab860391)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OESA-2023-1767 opensc security update

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the standard APIs to sma...

OESA-2023-1766 opensc security update

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the standard APIs to sma...

CVE-2023-46234

A flaw was found in browserify-sign node package. This issue may allow a malicious user to execute a signature forgery attack by not correctly checking cryptographic signatures for DSA data, resulting in a jeopardized environment. Mitigation No current mitigation is yet available for this flaw...

[SECURITY] Fedora 37 Update: mbedtls-2.28.5-1.fc37

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...

CVE-2023-46133 crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a...

CVE-2023-42492

EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key...

CVE-2023-42492 EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key

EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key...

CVE-2023-42492 EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key

EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key...

CVE-2023-42492

CVE-2023-42492 affects EisBaer Scada with a hard-coded cryptographic key (CWE-321). The root cause is use of a hard-coded key within the software, enabling potential disclosure or tampering of protected data. NVD lists a high/severe impact (Confidentiality, Integrity, Availability at high/critica...

Missing Cryptographic Step

Overview openssl is a package that wraps the OpenSSL library. Affected versions of this package are vulnerable to Missing Cryptographic Step when the EVPEncryptInitex2, EVPDecryptInitex2 or EVPCipherInitex2 functions are used. An attacker can cause truncation or overreading of key and...

CVE-2023-28804

An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105...

CVE-2023-28796

Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6...

Design/Logic Flaw

An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105...