CVE-2021-29704

CVE-2021-29704 affects IBM Security SOAR (Resilient) on-premises, stemming from use of weaker-than-expected cryptographic algorithms that could lead to information disclosure. The IBM Security SOAR/Resilient DR system allows TLS 1.0 connections, enabling potential decryption of highly sensitive i...

Security Bulletin: IBM Resilient Disaster Recovery (DR) system allows connections over TLS 1.0 (CVE-2021-29704)

Summary IBM Resilient Disaster Recovery DR system allows connections over TLS 1.0 Vulnerability Details CVEID: CVE-2021-29704 DESCRIPTION: IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base score: 5....

The vulnerability of the SSH server on the ROSA KOBALT operating system lies in the use of weak encryption algorithms such as RC4 and Blowfish. This allows attackers to circumvent cryptographic security measures.

The vulnerability of the SSH server on the ROS KOBALT operating system is related to the use of weak encryption algorithms such as RC4 and Blowfish. Exploiting this vulnerability allows a remote attacker to circumvent the cryptographic security measures...

hw: Special Register Buffer Data Sampling (SRBDS)

A new domain bypass transient execution attack known as Special Register Buffer Data Sampling SRBDS has been found. This flaw allows data values from special internal registers to be leaked by an attacker able to execute code on any core of the CPU. An unprivileged, local attacker can use this fl...

The vulnerability of Moxa EDR-810 microcontroller software lies in the use and storage of the cryptographic key in an unencrypted form, allowing attackers to exploit their privileges.

The vulnerability of Moxa EDR-810 microcontroller-based software lies in the use and storage of the cryptographic key in an unencrypted form. Exploiting this vulnerability allows a remote attacker to gain increased privileges...

Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets

A security researcher helped Valve, the makers of the gaming platform Steam, plug an easy-to-exploit hole that allowed users to add unlimited funds to their digital wallet. Simply by changing the account’s email address, the exploit allowed anyone to artificially boost their digital billfold to...

Revive Adserver: Use of a Broken or Risky Cryptographic Algorithm

revive-adserver utilizes a PRNG for session-token generation, this means that an attacker could theoretically be able to generate session tokens at random and take over accounts at random. This function does not generate cryptographically secure values, and should not be used for cryptographic...

Insecure Cryptographic Function

Lasso has insecure cryptographic functions. The vulnerability exists due to the lack of sanitization in the modauthmellon...

OpenSSL: Timing-based attacks on SSL/TLS with CBC encryption (CVE-2003-0078) - Windows

OpenSSL is prone to timing-based attacks on SSL/TLS with CBC encryption. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...

CVE-2021-36938

Windows Cryptographic Primitives Library Information Disclosure Vulnerability...

CVE-2021-36938

Windows Cryptographic Primitives Library Information Disclosure Vulnerability...

Information disclosure

Windows Cryptographic Primitives Library Information Disclosure Vulnerability...

CVE-2021-36938

CVE-2021-36938 affects the Windows Cryptographic Primitives Library and is described as a Windows information-disclosure vulnerability. The available sources identify a vulnerability in the Windows Cryptographic Primitives Library with a CONFIDENTIALITY impact (HIGH per CVSS 3.1) and MEDIUM overa...

Amazon AWS CloudFront 加密问题漏洞

Amazon AWS CloudFront is a content delivery network that provides basic services from Amazon.com, Inc.'s Web Services system. A security vulnerability exists in Amazon AWS CloudFront TLSv1.2 2019, where a related component uses a weak cryptographic algorithm resulting in a security risk...

CVE-2021-3047

A cryptographically weak pseudo-random number generator PRNG is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to...

Authentication flaw

A cryptographically weak pseudo-random number generator PRNG is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to...

CVE-2019-25052

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information...

Information disclosure

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information...

CVE-2019-25052

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information...

CVE-2019-25052

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information...