11812 matches found
Improper Verification of Cryptographic Signature
Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to improper enforcement of the SIGHASH value in the signature verification process. An attacker can submit non-compliant signatures that are incorrectly accepted as valid by providing...
Use of Hard-coded Cryptographic Key
Overview org.apache.syncope.core.idrepo:syncope-core-idrepo-logic is an Apache Syncope Core IdRepo Logic Affected versions of this package are vulnerable to Use of Hard-coded Cryptographic Key in the password encryption process. An attacker can recover original cleartext password values by...
Prompt Fencing: A Cryptographic Approach to Establishing Security Boundaries in Large Language Model Prompts
Large Language Models LLMs remain vulnerable to prompt injection attacks, representing the most significant security threat in production deployments. We present Prompt Fencing, a novel architectural approach that applies cryptographic authentication and data architecture principles to establish...
IBM Concert 加密问题漏洞
IBM Concert is a generative artificial intelligence-driven automated application management and monitoring tool based on the watsonx platform released in May 2024 by IBM. IBM Concert suffers from a cryptographic issue vulnerability that stems from the use of weak encryption algorithms, which can ...
CVE-2025-48507
The security state of the calling processor into Trusted Firmware TF-A is not used and could potentially allow non-secure processors access to secure memories, access to crypto operations, and the ability to turn on and off subsystems within the SOC...
AMD Zynq UltraScale+ 安全漏洞
AMD Zynq UltraScale+ is a multiprocessor system-on-chip from UltraMicroelectronics AMD. A security vulnerability exists in AMD Zynq UltraScale+ that originates from the unused security state of the calling processor and could result in a non-secure processor accessing secure memory or cryptograph...
wolfSSL 安全漏洞
wolfSSL CyaSSL is a small, portable embedded SSL programming library for use by embedded systems developers from wolfSSL, Inc. in the United States. A security vulnerability exists in wolfSSL that stems from compiler optimizations and time-side channels introduced by CPU architectural limitations...
Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to loss of confidentiality [CVE-2025-1993]
Summary IBM App Connect Enterprise Certified Container DesignerAuthoring instances store their flows in a database that is protected by weaker than expected cryptographic algorithms that could be decrypted by a local user. This bulletin provides patch information to address the vulnerability in I...
📄 eGovFramework 4.3.1 File Upload / Unauthenticated Encryption Oracle
eGovFramework versions 4.3.1 and below suffer from unauthenticated file upload and encryption oracle vulnerabilities. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory Information Title: 2 vulnerabilities in Egovframe Advisory URL: https://pierrekim.github.io/advisories/2025-egovframe.txt...
IBM Concert 加密问题漏洞
IBM Concert is a generative artificial intelligence-driven automated application management and monitoring tool based on the watsonx platform released in May 2024 by IBM. IBM Concert suffers from a cryptographic issue vulnerability that stems from not properly enabling HTTP Strict Transport...
CVE-2025-13316
Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to...
CVE-2025-13316
Twonky Server 8.5.2 on Linux and Windows is affected by CVE-2025-13316, a cryptographic flaw caused by hard-coded keys. An attacker who obtains the encrypted administrator password can decrypt it with the static keys to obtain the plaintext password and gain administrator-level access to Twonky S...
CVE-2025-52457
Observable Timing Discrepancy CWE-208 in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a distributed in 9.30.2881 MR3, 9.2...
PT-2025-47514
Name of the Vulnerable Software and Affected Versions Twonky Server version 8.5.2 Description Twonky Server version 8.5.2 on Linux and Windows contains a cryptographic flaw due to the use of hard-coded cryptographic keys. An attacker who knows the encrypted administrator password can decrypt it...
Improper Verification Of Cryptographic Signature
Apache Spark is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to the use of an unauthenticated default encryption cipher AES/CTR/NoPadding for RPC communication when spark.network.crypto.enabled is true and no cipher is explicitly configured, which allow...
Desktop Alert Unspecified Vulnerability in PingAlert (CNVD-2025-29434)
Desktop Alert PingAlert is a network status monitoring tool developed by DesktopAlert, Inc. and is mainly used to monitor the status of network devices in real time and send alerts. An unspecified vulnerability exists in Desktop Alert PingAlert, which arises from the presence of corrupt or insecu...
Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-56754)
crypto: vulnerability due to passing an incorrect parameter type to devmaddactionorreset in the CAAM driver, which is fixed by ensuring the correct parameter type is used to properly release resources. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-o...
ROS-20251117-04
A vulnerability in the LXD container and lightweight virtual machine management system is related to redundant API data output. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to potentially sensitive information The vulnerability in the LXD container and...
CVE-2025-9317 AVEVA Edge Use of a Broken or Risky Cryptographic Algorithm
The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes...
