Code injection

IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 134177...

Tips on How to Fight Back Against DNS Spoofing Attacks

The Domain Name System DNS, known as the phone book for the internet, was recently retuned to improve performance as well as include new security provisions to protect against Distributed Denial of Service DDoS attacks. DNS Flag Day drew a line in the sand for noncompliant authoritative DNS serve...

CVE-2017-1695

Summary: CVE-2017-1695 affects IBM QRadar SIEM (QRadar/QRM/QVM/QRIF/QNI) 7.2.x and 7.3.x. It arises from using weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. The IBM bulletin lists affected versions (7.2.0–7.2.8 Patch 11; 7.3....

CVE-2017-1695

IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 134177...

Security advisory YSA-2019-02 | Yubico

Who should read this advisory? Customers, IT Managers, or FIPS Crypto Officers who use or manage YubiKey FIPS Series devices. An issue exists in YubiKey FIPS Series devices, versions 4.4.2 and 4.4.4 please note, there is no released firmware version 4.4.3. , where the first set of random values...

Hardcoded credentials

The Dell Wyse Password Encoder in ThinLinux2 versions prior to 2.1.0.01 contain a Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacker could reverse engineer the cryptographic system used in the Dell Wyse Password Encoder to discover the hard coded private key and decryp...

CVE-2018-15781

The Dell Wyse Password Encoder in ThinLinux2 versions prior to 2.1.0.01 contain a Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacker could reverse engineer the cryptographic system used in the Dell Wyse Password Encoder to discover the hard coded private key and decryp...

CVE-2018-15781

CVE-2018-15781 concerns Dell Wyse Password Encoder on ThinLinux2 versions prior to 2.1.0.01, which contains a hard-coded cryptographic key. An unauthenticated remote attacker could reverse engineer the cryptographic system to discover the private key and decrypt locally stored ciphertext. The vul...

CVE-2018-15781 DSA-2019-022: Dell Wyse Password Encoder Hard-coded Cryptographic Key Vulnerability

The Dell Wyse Password Encoder in ThinLinux2 versions prior to 2.1.0.01 contain a Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacker could reverse engineer the cryptographic system used in the Dell Wyse Password Encoder to discover the hard coded private key and decryp...

Siemens Intel Active Management Technology of SIMATIC IPCs

1. EXECUTIVE SUMMARY CVSS v3 6.7 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: Intel Active Management Technology AMT of SIMATIC IPCs Vulnerabilities: Cryptographic Issues, Improper Restriction of Operations within the Bounds of a Memory Buffer, Resource...

TAU Threat Intelligence Notification: Java Embedded MSI Files

Summary Application whitelisting provides environments with access controls to stop unauthorized software from executing. This is accomplished by utilizing file and folder attributes including but not limited to file path, filename, digital signature, publisher, cryptographic hash and product nam...

Security Bulletin: IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect for Virtual Environments allow legacy SSL/TLS protocols and ciphers to be used (CVE-2018-1545)

Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Client and IBM Spectrum Protect for Virtual Environments formerly Tivoli Storage Manager for Virtual Environments, allow legacy SSL/TLS protocols and ciphers to be used. This can result in the use of weaker than expected cryptograph...

Security Bulletin: IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect for Virtual Environments allow Triple DES (3DES) ciphers to be used (CVE-2018-1785)

Summary IBM Spectrum Protect formerly Tivoli Storage Manager and IBM Spectrum Protect for Virtual Environments allow Triple DES 3DES ciphers to be used. This can result in the use of weaker than expected cryptographic algorithms. Vulnerability Details CVEID: CVE-2018-1785 DESCRIPTION: IBM Tivoli...

Information disclosure

A Cryptographic Issue CWE-310 vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure...

CVE-2018-7839

A Cryptographic Issue CWE-310 vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure...

CVE-2018-7839

A Cryptographic Issue CWE-310 vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure...

CVE-2018-7839

A Cryptographic Issue CWE-310 vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure...

CVE-2018-7839

CVE-2018-7839 affects Schneider Electric IIoT Monitor 3.1.38 and is caused by a hard-coded cryptographic key in the AESEncryption component, leading to potential information disclosure. The risk context in the connected docs notes a cryptographic issue with confidentiality impact (C–H) and cites ...

Security Bulletin: IBM QRadar SIEM uses outdated hash algorithms. (CVE-2017-1695)

Summary The software uses an outdated or insecure cryptographic library or it is using a proprietary crypto standard which is likely to be vulnerable. Vulnerability Details CVEID: CVE-2017-1695 DESCRIPTION: IBM QRadar uses weaker than expected cryptographic algorithms that could allow an attacker...

OSCI-Transport Library 1.2 1.8.1 Insecure Crypto / Signature Bypass

A blog post with further information has been released on this topic as well: https://r.sec-consult.com/osci SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: OSCI-Transport Library 1.2...