11950 matches found
CVE-2022-1746 2.2.8 INCORRECT PRIVILEGE ASSIGNMENT CWE-266
The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic secrets used to protect election information. An attacker could leverage this vulnerability to gain access to sensitive information and...
CVE-2022-1746 2.2.8 INCORRECT PRIVILEGE ASSIGNMENT CWE-266
The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic secrets used to protect election information. An attacker could leverage this vulnerability to gain access to sensitive information and...
CVE-2022-1746
CVE-2022-1746 concerns Dominion Voting Systems ImageCast X. The vulnerability is an authentication/privilege assignment flaw in the poll-worker authentication mechanism that could expose cryptographic secrets protecting election information. An attacker could leverage this to access sensitive dat...
PT-2022-19547 · Telesoft · Telesoft Vitalpbx
Name of the Vulnerable Software and Affected Versions: Telesoft VitalPBX versions prior to 3.2.1 Description: The issue concerns missing access control in the backup system, allowing attackers to access sensitive data such as PJSIP and SIP extension credentials, cryptographic keys, and voicemails...
On the Subversion of NIST by the NSA
Nadiya Kostyuk and Susan Landau wrote an interesting paper: "Dueling Over DUALECDRBG: The Consequences of Corrupting a Cryptographic Standardization Process": Abstract: In recent decades, the U.S. National Institute of Standards and Technology NIST, which develops cryptographic standards for...
PT-2022-3094 · Omron · Sysmac Studio +1
Name of the Vulnerable Software and Affected Versions: Omron SYSMAC Nx product family PLCs NJ series, NY series, NX series, and PMAC series through 2022-005-18 Description: The issue is related to the lack of cryptographic authentication in the Omron SYSMAC Nx product family PLCs. This allows an...
PT-2022-3093 · Omron · Omron Sysmac Cx
Name of the Vulnerable Software and Affected Versions: Omron SYSMAC Cx product family PLCs CS series, CJ series, and CP series through 2022-05-18 Description: The issue is related to a lack of cryptographic authentication in the Omron FINS 9600/TCP protocol used for engineering purposes, includin...
Tracking People via Bluetooth on Their Phones
Weve always known that phones--and the people carrying them--can be uniquely identified from their Bluetooth signatures, and that we need security techniques to prevent that. This new research shows that thats not enough. Computer scientists at the University of California San Diego proved in a...
Rundeck plaintext storage vulnerability
Rundeck is an open source automation service with a Web console, command line tools and WebAPI from Rundeck, Inc. that is primarily used to run automation tasks. versions 4.2.0 and 4.2.1 of Rundeck contain a plaintext storage vulnerability that stems from not properly enabling the Key Storage...
Hertzbleed exposes computers’ secret whispers
Hertzbleed is the name for a vulnerability that can be used to obtain cryptographic keys and other secret data from Intel and AMD CPUs, remotely. It works by monitoring changes in power consumption, which can be deduced by the careful timing of known workloads, thanks to a processor power saving...
New Hertzbleed Side Channel Attack Affects All Modern AMD and Intel CPUs
A newly discovered security vulnerability in modern Intel and AMD processors could let remote attackers steal encryption keys via a power side channel attack. Dubbed Hertzbleed by a group of researchers from the University of Texas, the University of Illinois Urbana-Champaign, and the University ...
CVE-2022-24436
A potential vulnerability in some Intel® processors using frequency scaling may allow an authenticated attacker to execute a timing attack to potentially enable information disclosure. Mitigation Currently, there is no mitigation for this flaw. Intel has provided some guidance to developers of...
Rundeck 安全漏洞
Rundeck is an open source automation service with a Web console, command line tools and WebAPI from Rundeck, Inc. that is primarily used to run automation tasks. versions 4.2.0 and 4.2.1 of Rundeck contain a plaintext storage vulnerability that stems from not properly enabling the Key Storage...
Insecure Cryptographic Function
Biscuit has insecure cryptographic function. The vulnerability exists due to the use a signature algorithm which allows an attacker to forge Γ-signatures and create token with any access level to bypass authentication and authorization...
Frequency Scaling Timing Power Side-Channels
Bulletin ID: AMD-SB-1038 Potential Impact: Information Disclosure Severity: Medium Summary AMD is aware of the academic research paper titled “Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86”. AMD has been notified the researchers intend to submit their paper to...
Software Developer Guidance for Power Advisory
Summary: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing guidance to address this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-24436 Description: Observable behavioral in power management throttling for some Inte...
MIT Researchers Discover New Flaw in Apple M1 CPUs That Can't Be Patched
A novel hardware attack dubbed PACMAN has been demonstrated against Apple's M1 processor chipsets, potentially arming a malicious actor with the capability to gain arbitrary code execution on macOS systems. It leverages "speculative execution attacks to bypass an important memory protection...
CVE-2022-23138
ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, and it may face the risk of attack...
