Design/Logic Flaw

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126859...

CVE-2017-1366

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126859...

CVE-2017-1366

CVE-2017-1366 affects IBM Security Identity Governance Virtual Appliance (IGI) 5.2 through 5.2.3.2, where weaker-than-expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. The issue is tied to IGI’s deployment and crypto handling, with IBM noting a rem...

CVE-2017-1366

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126859...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to multiple security vulnerabilities. There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 and IBM® Runtime Environment Java™ Version 8 included in this release ...

Security Bulletin : Multiple vulnerabilities in IBM GSKit affect IBM Host On-Demand.

Summary GSKit is an IBM component that is used by Host On-Demand. GSKit that is shipped with Host On-Demand contains multiple security vulnerabilities .Host On-Demand has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2018-1426 DESCRIPTION:IBM GSKit duplicates the PRNG state acros...

USN-3727-1: Bouncy Castle vulnerabilities

It was discovered that Bouncy Castle incorrectly handled certain crypto algorithms. A remote attacker could possibly use these issues to obtain sensitive information, including private keys...

Json-jwt did not verify the cryptographic signature for data

The json-jwt rubygem version = 0.5.0 && 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network...

GHSA-MJ4X-WCXF-HM8X Json-jwt did not verify the cryptographic signature for data

The json-jwt rubygem version = 0.5.0 && 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network...

[SECURITY] Fedora 27 Update: python-cryptography-2.3-1.fc27

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...

Code injection

ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recovery for a CBC based ciphersuite via a timing-based side-channel attack. This vulnerability exists because of an incorrect fix with a wrong SHA-384 calculation for CVE-2013-0169...

SAML Authentication Bypass

Wizkunde SAMLBase is vulnerable to authentication bypasses. This is due to the inconsistent handling of comments within XML nodes, resulting in the incorrect parsing of the inner text of XML nodes. This causes any inner text after the comment to be lost prior to signing of the SAML message. An...

Update your devices: New Bluetooth flaw lets attackers monitor traffic

By Waqas The Bluetooth flaw also opens door to a man-in-the-middle attack. The IT security researchers at Israel Institute of Technology have discovered a critical security vulnerability in some implementations of the Bluetooth standard in which not all the parameters involved are appropriately...

CVE-2018-5387

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service...

CVE-2018-5387

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service...

CVE-2017-3225

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt...

CVE-2017-3225

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt...

CVE-2018-5387

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service...

CVE-2017-3225 Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector that may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt...

CVE-2018-5387

CVE-2018-5387 affects Wizkunde SAMLBase. Root cause: incorrect handling of XML DOM traversal/canonicalization APIs can cause SAML data to be manipulated without invalidating the cryptographic signature, enabling potential authentication bypass of SAML service providers. Affected Wizkunde SAMLBase...