USN-5158-1: ImageMagick vulnerabilities

It was discovered that ImageMagick incorrectly handled certain values when processing visual effects based image files. By tricking a user into opening a specially crafted image file, an attacker could crash the application causing a denial of service. CVE-2021-20244 It was discovered that...

USN-5158-1 imagemagick vulnerabilities

It was discovered that ImageMagick incorrectly handled certain values when processing visual effects based image files. By tricking a user into opening a specially crafted image file, an attacker could crash the application causing a denial of service. CVE-2021-20244 It was discovered that...

The vulnerability in the implementation of the tipc_crypto_key_rcv() function for the TIPC protocol, which is used for intra-cluster communication in Linux operating systems, allows a attacker to cause a service failure or gain increased privileges.

The vulnerability of the implementation of the tipccryptokeyrcv function in the Linux operating system’s Transparent Inter-Process Communication TIPC kernel relates to insufficient input validation when processing MSGCRYPTO messages. Exploiting this vulnerability can allow an attacker to cause...

CVE-2021-38891

IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 209508...

Code injection

IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 209508...

CVE-2021-38891

IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 209508...

CVE-2021-38891

CVE-2021-38891 affects IBM Sterling Connect:Direct Web Services (versions 1.0 and 6.0). The issue is weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The IBM advisory (B1E... bulletin) confirms affected products and versions, and ...

bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data...

Security Bulletin: Weak Cryptographic Control Vulnerability Affects IBM Sterling Connect:Direct Web Services (CVE-2021-38891)

Summary IBM Sterling Connect:Direct Web Services used weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-38891 DESCRIPTION: IBM Sterling Connect:Direct Web...

The vulnerability of the serial interface converter NPort IAW5250A-6I/O lies in the use of a hard-coded cryptographic key, which allows a hacker to modify the device’s firmware.

The vulnerability of the NPort IAW5250A-6I/O serial interface converter is related to the use of a rigidly encoded cryptographic key. Exploiting this vulnerability could allow an attacker to modify the device’s firmware remotely...

EdgeX Foundry 加密问题漏洞

EdgeX Foundry is an open source project to build a common open framework for IoT edge computing. A cryptographic issue vulnerability exists in EdgeX's Functions SDK that allows an attacker to decrypt messages via unspecified vectors...

Palo Alto Networks PAN-OS 8.1.x < 8.1.0 / 9.0.x < 9.0.0 / 9.1.x < 9.1.0 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x prior to 8.1.0 or 9.0.x prior to 9.0.0 or 9.1.x prior to 9.1.0. It is, therefore, affected by a vulnerability. - In versions of Palo Alto Networks PAN-OS software earlier than PAN-OS 10.0, the DHE cipher available for us...

Philips Patient Information Center iX (PIC iX) and Efficia CM Series

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable from adjacent network/low attack complexity Vendor: Philips Equipment: Patient Information Center iX PIC iX and Efficia CM Series Vulnerabilities: Improper Input Validation, Use of Hard-coded Cryptographic Key, Use of a Broken or Risky...

CVE-2021-0152

Improper verification of cryptographic signature in the installer for some IntelR Wireless BluetoothR and KillerTM BluetoothR products in Windows 10 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2021-0152

Improper verification of cryptographic signature in the installer for some IntelR Wireless BluetoothR and KillerTM BluetoothR products in Windows 10 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2021-0152

CVE-2021-0152 affects Intel® Wireless Bluetooth® and Killer™ Bluetooth® installer on Windows 10. The Red Hat/NVD entries and Intel advisory confirm the root cause: improper verification of the cryptographic signature in the installer, enabling a local, authenticated user to potentially cause a de...

Oracle Linux 8 : lasso (ELSA-2021-4325)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4325 advisory. - Resolves: rhbz1951653 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses rhel-8 - Resolves: rhbz1951653 - CVE-2021-28091...

Unspecified Vulnerability in IBM MQ (CNVD-2021-88183)

IBM MQ IBM WebSphere MQ is a messaging middleware product from IBM. The product is mainly for the service-oriented architecture SOA to provide a reliable and proven messaging backbone. A security vulnerability exists in IBM MQ that stems from a network system or product that does not properly use...

The vulnerability of the Apache OpenOffice office software, related to errors in checking the cryptographic signature, allows a perpetrator to manipulate signed documents.

The vulnerability of the Apache OpenOffice office software is related to errors during the verification of the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to manipulate signed documents remotely...

Unspecified Vulnerability in IBM Tivoli Key Lifecycle Manager (CNVD-2021-88185)

IBM Tivoli Key Lifecycle Manager TKLM is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. A security vulnerability exists in IBM Tivoli Key Lifecycle Manager that stems fr...