7829 matches found
macOS 14.x < 14.3 Multiple Vulnerabilities (HT214061)
The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.3. It is, therefore, affected by multiple vulnerabilities: - The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS...
jsrsasign Security Vulnerabilities
The jsrsasign package is an open source cryptographic library from the individual developer Kenji Urashima in Japan. A security vulnerability exists in jsrsasign versions prior to 11.0.0, which stems from the susceptibility to Observable Discrepancy in the decryption process of RSA PKCS1.5 or...
Medium: python-pycryptodomex
Issue Overview: PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. CVE-2023-52323 Affected Packages: python-pycryptodomex Issue Correction: Run dnf update python-pycryptodomex --releasever 2023.3.20240122 to update your...
GHSA-RH63-9QCF-83GF Marvin Attack of RSA and RSAOAEP decryption in jsrsasign
Impact RSA PKCS1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability. Patches update to jsrsasign 11.0.0. Workarounds Find and replace RSA and RSAOAEP decryption with other crypto library. References https://people.redhat.com/hkario/marvin/...
Marvin Attack of RSA and RSAOAEP decryption in jsrsasign
Impact RSA PKCS1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability. Patches update to jsrsasign 11.0.0. Workarounds Find and replace RSA and RSAOAEP decryption with other crypto library. References https://people.redhat.com/hkario/marvin/...
Nettle: Denial of Service
Background Nettle is a cryptographic library that is designed to fit easily in almost any context: In cryptographic toolkits for object-oriented languages, such as C++, Python, or Pike, in applications like lsh or GnuPG, or even in kernel space. Description Multiple vulnerabilities have been...
EulerOS Virtualization 2.9.0 : qemu (EulerOS-SA-2023-3111)
According to the versions of the qemu package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtiocryptohandlesymreq...
GLSA-202401-24 : Nettle: Denial of Service
The remote host is affected by the vulnerability described in GLSA-202401-24 Nettle: Denial of Service - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application...
EulerOS 2.0 SP11 : linux-sgx (EulerOS-SA-2023-3047)
According to the versions of the linux-sgx packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a...
Command Execution Vulnerability in Electronic Document Security Management System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-09027)
Electronic document security management system is a controllable authorization of electronic document security sharing management system, using real-time dynamic encryption and decryption protection technology and real-time rights recovery mechanism, to provide all kinds of electronic documents...
nss security update
An update is available for nss. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Network Security Services NSS is a set of libraries designed to support the...
CVE-2023-49256
It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...
CVE-2023-49256
It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...
Authorization
It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...
CVE-2023-49256
CVE-2023-49256 allows unauthenticated retrieval of a device’s configuration backup and decryption of passwords, using a hardcoded static key. Red Hat’s linked entries reiterate the issue and describe the root cause as hardcoded credentials embedded in the device, enabling confidentiality impact (...
CVE-2023-49256 Predictable encryption passphrase used in publicly accessible configuration file
It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...
OESA-2024-1043 libssh security update
The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote...
OESA-2024-1042 libssh security update
The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote...
CVE-2023-49256: Use of Hard-coded Cryptographic Key
It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...
PyCryptodome < 3.19.1 Side Channel Leak
The version of PyCryptodome installed on the remote host is prior to 3.19.1. It is, therefore, affected by a vulnerability. - A side-channel leakage with OAEP decryption could be exploited to carry out a Manger attack. CVE-2023-52323 Note that Nessus has not tested for this issue but has instead...