208 matches found
CVE-2021-36226
Western Digital My Cloud devices prior to OS5 are vulnerable due to firmware upgrade files not being cryptographically signed. The root cause is the lack of signature verification for firmware updates, enabling potential tampering with updates and impacting integrity and availability. Reported as...
Golf may allow attacker to bypass CSRF protections due to weak PRNG
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests...
CVE-2016-15005 Cryptographically weak random number generation in github.com/dinever/golf
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests...
CVE-2016-15005 Cryptographically weak random number generation in github.com/dinever/golf
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests...
CVE-2016-15005
CVE-2016-15005 affects the Go project github.com/dinever/golf. The root cause is CSRF tokens generated with math/rand, which is not cryptographically secure, allowing an attacker to predict token values and bypass CSRF protections with relatively few requests. Impact described across sources: CSR...
CVE-2022-23472
Passeo (open source Python password generator) before v1.0.5 uses the Python random module for value generation, which is non-cryptographically secure. This may allow a motivated attacker to guess generated passwords. The issue is addressed in v1.0.5; upgrade to that version. No public workaround...
Passeo 安全特征问题漏洞
Passeo is a Python password generator by the individual developer Arjun Sharda. A security signature issue vulnerability exists in versions of Passeo prior to 1.0.5 that stems from a reliance on the python random library for random value selection, which relies on a non-cryptographically secure...
CVE-2022-35255
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/cryptokeygen.cc. There are two problems with this: 1 It does not check the return value, it assumes EntropySource always succeeds, but it can a...
CVE-2022-35255: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/cryptokeygen.cc. There are two problems with this: 1 It does not check the return value, it assumes EntropySource always succeeds, but it can a...
Apptainer: Lack of Digital Signature Hash Verification
Background Apptainer is the container system for secure high-performance computing. Description The Go module "sif" version 2.8.0 and older, which is a statically linked dependency of Apptainer, does not verify that the hash algorithms used are cryptographically secure when verifying digital...
SIF's Digital Signature Hash Algorithms Not Validated
Impact The github.com/sylabs/sif/v2/pkg/integrity package does not verify that the hash algorithms used are cryptographically secure when verifying digital signatures. Patches A patch is available in version = v2.8.1 of the module. Users are encouraged to upgrade. The patch is commit...
UBUNTU-CVE-2022-39237
syslabs/sif is the Singularity Image Format SIF reference implementation. In versions prior to 2.8.1the github.com/sylabs/sif/v2/pkg/integrity package did not verify that the hash algorithms used are cryptographically secure when verifying digital signatures. A patch is available in version =...
CVE-2022-39237
syslabs/sif is the Singularity Image Format SIF reference implementation. In versions prior to 2.8.1the github.com/sylabs/sif/v2/pkg/integrity package did not verify that the hash algorithms used are cryptographically secure when verifying digital signatures. A patch is available in version =...
Apache Pulsar Java Client vulnerable to Improper Certificate Validation
Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar Broker are vulnerable. Authentication...
NodeBB < 1.19.8, 2.x < 2.0.1 Account Takeover Vulnerability
NodeBB is prone to an account takeover vulnerability via a cryptographically weak PRNG in SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2022-36045
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. utils.generateUUID, a helper function available in essentially all versions of NodeBB as far back as v1.0.1 and...
CVE-2022-36045 Account takeover via cryptographically weak PRNG in NodeBB Forum
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. utils.generateUUID, a helper function available in essentially all versions of NodeBB as far back as v1.0.1 and...
GHSA-P4CC-W597-6CPM Cryptographically weak PRNG in `utils.generateUUID`
In Brief utils.generateUUID, a helper function available in essentially all versions of NodeBB as far back as v1.0.1 and potentially earlier used a cryptographically insecure Pseudo-random number generator Math.random, which meant that a specially crafted script combined with multiple invocations...
