Google Rolling Out Passkey Passwordless Login Support to Android and Chrome

Google on Wednesday officially rolled out support for passkeys, the next-generation authentication standard, to both Android and Chrome. "Passkeys are a significantly safer replacement for passwords and other phishable authentication factors," the tech giant said. "They cannot be reused, don't le...

Nextcloud: Secure view trivial to bypass

The secure view feature in Nextcloud was vulnerable to bypassing, allowing users to download files without watermarks. This was possible by using the richdocuments app and adding "/contents" to the URL. The checkbox indicating that downloading is not allowed was misleading, and a solution could b...

JDK: exposure of sensitive information using a combination of flaws and configurations

IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188...

PT-2023-6741 · Ibm +3 · Jsse +5

Name of the Vulnerable Software and Affected Versions: IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE versions 8.0.7.0 through 8.0.7.11 Description: The issue is related to the use of flawed cryptographic algorithms in the Java Secure Socket Extension JSSE and IBMJCEPlus...

Weak Cryptography

nodejs contains weak encryption. Weak randomness in WebCrypto keygen allows remote unauthenticated attackers to gain access to sensitive information in the system...

Security Bulletin: IBM Sterling Connect:Direct for UNIX is affected by a security vulnerability in OpenSSL (CVE-2011-4576)

Abstract A security vulnerability has been discovered in the OpenSSL libraries included in IBM Sterling Connect:Direct for UNIX that results in a security vulnerability in IBM Sterling Connect:Direct for UNIX. Content VULNERABILITY DETAILS: CVE ID : CVE-2011-4576 DESCRIPTION: IBM Sterling...

Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is affected by a security vulnerability in OpenSSL (CVE-2011-4576)

Abstract A security vulnerability has been discovered in the OpenSSL libraries included in IBM Sterling Connect:Direct for Microsoft Windows resulting in a security vulnerability in IBM Sterling Connect:Direct for Microsoft Windows. Content VULNERABILITY DETAILS: CVE ID: CVE-2011-4576 DESCRIPTION...

PT-2022-33885 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.61 Description: The issue is related to a problem in the crypto: hisilicon/sec module where the system does not sleep when in softirq. The actual impact and attack plausibility have not yet been proven...

Planning Go 1.20 Cryptography Work

As you might know, I left Google in spring to try and make the concept of a professional Open Source maintainer a thing. Im staying on as a maintainer of the Go cryptography standard library, and I am going to seek funding from companies that rely on it, want to ensure its security and reliabilit...

The vulnerability of the python-cryptography package, a programming language interpreter for Python, allows attackers to gain unauthorized access to protected information.

The vulnerability of the python-cryptography package, a programming language interpreter for Python, is related to errors in RSA key management. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

Security Bulletin: Multiple vulnerabilities found in IBM DB2 which is shipped with IBM® Intelligent Operations Center(CVE-2021-38931, CVE-2021-29678, CVE-2021-20373, CVE-2021-39002, CVE-2021-38926)

Summary Multiple vulnerabilities have been identified in DB2 which is shipped with IBM® Intelligent Operations Center. Information about these vulnerabilities affecting IBM® Intelligent Operations Center have been published and addressed the applicable CVEs. Vulnerability Details...

AZL-43348 CVE-2021-43565 affecting package libcontainers-common for versions less than 20210626-5

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server...

CVE-2021-43565

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server...

AZL-43341 CVE-2021-43565 affecting package cri-o for versions less than 1.22.3-5

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server...

AZL-43338 CVE-2021-43565 affecting package gh for versions less than 2.13.0-19

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server...

Moderate: Red Hat Security Advisory: openssl security and bug fix update

An update for openssl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

ALSA-2022:6224 Moderate: openssl security and bug fix update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: crehash script allows command injection CVE-2022-1292 openssl: Signer certificate verification...

CVE-2022-37177

HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it is inconsistent with CVE ID assignment rules for cloud services, and no product with version V1.0 exists. Furthermore, the rail-fence...

CVE-2022-37177

The CVE-2022-37177 entry concerns the HireVue Hiring Platform. Affected product: HireVue Hiring Platform, V1.0. Issue described as Use of a Broken or Risky Cryptographic Algorithm, with notes that the vendor disputes this claim and questions CVE ID rules, including that no product with V1.0 may e...

The vulnerability of the Python programming language’s cryptographic interpreter package allows a hacker to execute arbitrary code.

The vulnerability of the Python programming language’s cryptography interpreter is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the target system by sending specially crafted data...