CVE-2021-3680

showdoc is vulnerable to Missing Cryptographic Step...

CVE-2021-3680

showdoc is vulnerable to Missing Cryptographic Step...

Design/Logic Flaw

showdoc is vulnerable to Missing Cryptographic Step...

CVE-2021-3678

CVE-2021-3678 affects the showdoc project (star7th/showdoc) with a cryptographically weak PRNG. Connected sources (GHSA, Red Hat, OSV, CVE lists) consistently describe usage of insecure randomness (e.g., MD5-based/low-entropy paths, time/rand reliance) as the root cause. Impact details in the ref...

CVE-2021-3680

CVE-2021-3680 relates to showdoc and centers on a missing cryptographic step due to a hardcoded salt in the user password hash function. Documents from GHSA-8VH3-29MR-M9XG and PT-2021-21367 confirm this flaw and describe the use of a fixed salt, implying weaknesses in password hashing. No concret...

SUSE SLED12 / SLES12 Security Update : lasso (SUSE-SU-2021:2589-1)

The remote SUSE Linux SLED12 / SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2589-1 advisory. - CVE-2021-28091: Fixed XML signature wrapping vulnerability when parsing SAML responses. bsc1186768 Tenable has extracted the...

CVE-2021-37160

A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There is no firmware validation e.g., cryptographic signature validation during a File Upload for a firmware update...

Input validation

A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There is no firmware validation e.g., cryptographic signature validation during a File Upload for a firmware update...

CVE-2021-37160

A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. There is no firmware validation e.g., cryptographic signature validation during a File Upload for a firmware update...

[SECURITY] Fedora 33 Update: mbedtls-2.16.11-1.fc33

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

[SECURITY] Fedora 34 Update: mbedtls-2.16.11-1.fc34

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

Fedora: Security Advisory for mbedtls (FEDORA-2021-165969af24)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Use of a Broken or Risky Cryptographic Algorithm in hdinnovations/unit3d-community-edition

✍️ Description The referenced code block uses PHP's native md5 and uniqid functions to generate the attributes named passkey and rsskey - both of which are to be considered cryptographically insecure due to their usage of uniqid which is not to be considered cryptographically secure. 🕵️‍♂️ Proof of...

Security Bulletin: A vulnerability has been found in IBM Cloud Pak for Applications v4.3 where insecure http communications is used

Summary A vulnerability has been found in IBM Cloud Pak for Applications v4.3 where insecure http communications is used Vulnerability Details CVEID: CVE-2021-20360 DESCRIPTION: IBM Cloud Pak for Applications uses weaker than expected cryptographic algorithms that could allow an attacker to decry...

Security Bulletin: IBM Tivoli Netcool/Impact uses weaker than expected cryptographic algorithms (CVE-2021-29794)

Summary A vulnerability has been identified in the SSH server configuration shipped with IBM Tivoli Netcool/Impact 7.1.0.20 and 7.1.0.21. Vulnerability Details CVEID: CVE-2021-29794 DESCRIPTION: IBM Tivoli Netcool/Impact 7.1.0.20 and 7.1.0.21 uses an insecure SSH server configuration which enable...

The vulnerability of the cryptographic module of microprogramming software for Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) allows a perpetrator to trigger a service failure.

The vulnerability of the cryptographic module of microprogramming software for Cisco Adaptive Security Appliances ASA and Cisco Firepower Threat Defense FTD is related to errors in encryption and decryption processes. Exploiting this vulnerability can allow a malicious actor to cause service...

in yiisoft/yii2

✍️ Description Insecure randomness errors occur when a function that can produce predictable values is used as a source of randomness in security-sensitive context. In this case the function that generates weak random numbers is mtrand in BaseMailer.php at line 346. 🕵️‍♂️ Proof of Concept ?php echo...

in yiisoft/yii2

✍️ Description Insecure randomness errors occur when a function that can produce predictable values is used as a source of randomness in security-sensitive context. In this case the function that generates weak random numbers is mtrand in CaptchaAction.php at line 217. 🕵️‍♂️ Proof of Concept ?php...

AVEVA System Platform Incorrect Authentication Vulnerability

AVEVA System Platform is an application from AVEVA UK. responsive, standards-driven and scalable foundation for regulatory, enterprise SCADA, MES and IIoT applications. AVEVA System Platform has a security vulnerability that stems from the software not verifying or incorrectly verifying the...

SUSE Rancher K3s 安全漏洞

SUSE Rancher K3s is a CNCF sandboxing project from SUSE Germany that provides a lightweight but powerful certified Kubernetes distribution. A security vulnerability exists in SUSE Rancher K3s that allows any user with direct access to a datastore, or a copy of a datastore backup, to extract the...