7985 matches found
CVE-2025-36150: Use of a Broken or Risky Cryptographic Algorithm
IBM Concert 1.0.0 through 2.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...
CVE-2025-63433
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a static value within the application's code. An attacker with the ability to intercept network traffic can use this hardcoded key to decrypt,...
IBM Concert encryption problem vulnerabilities
IBM Concert is a generative artificial intelligence-driven automated application management and monitoring tool based on the watsonx platform released in May 2024 by IBM. IBM Concert suffers from a cryptographic issue vulnerability that stems from the use of weak encryption algorithms, which can ...
CVE-2025-13470
In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key PKESK packets to be left uninitialized except for zeroing, resulting in it always being an all-zero byte array. Any data encrypted using public-key encryption in this release...
UBUNTU-CVE-2025-13470
In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key PKESK packets to be left uninitialized except for zeroing, resulting in it always being an all-zero byte array. Any data encrypted using public-key encryption in this release...
CVE-2025-13470
CVE-2025-13470 affects RNP prior to 0.18.1, where a refactoring regression left the symmetric session key for PKESK packets uninitialized beyond zeroing. The result is an all-zero session key for PKESK, allowing data encrypted with public-key encryption to be decrypted trivially, compromising con...
JLSEC-2025-216 In Mbed TLS before 3.1.0, `psa_aead_generate_nonce` allows policy bypass or oracle-based decryption...
In Mbed TLS before 3.1.0, psaaeadgeneratenonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application...
JLSEC-2025-232 Side channel in RSA key generation and operations (SSBleed, M-Step)
Vulnerability Mbed TLS's modular inversion routine and GCD routine are vulnerable to local timing attacks in a number of settings discussed below. These functions are used in RSA, making the following operations vulnerable in all configurations: - RSA key generation with any API mbedtlsrsagenkey...
JLSEC-2025-215 In Mbed TLS before 2.28.0 and 3.x before 3.1.0, `psa_cipher_generate_iv` and `psa_cipher_encrypt`...
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psaciphergenerateiv and psacipherencrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application...
PT-2025-48513
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa cipher generate iv and psa cipher encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application...
wolfSSL security vulnerabilities
wolfSSL CyaSSL is a small, portable embedded SSL programming library for use by embedded systems developers from wolfSSL, Inc. in the United States. A security vulnerability exists in wolfSSL that stems from an integer underflow during the XChaCha20-Poly1305 decryption process, which could lead t...
PT-2025-48514
In Mbed TLS before 3.1.0, psa aead generate nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application...
PT-2025-47788
Name of the Vulnerable Software and Affected Versions RNP version 0.18.0 Description A regression in RNP version 0.18.0 causes the symmetric session key used for Public-Key Encrypted Session Key PKESK packets to remain uninitialized, resulting in it always being an all-zero byte array. This allow...
TencentOS Server 4: libgcrypt (TSSA-2024:0963)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0963 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
kernel: tls: separate no-async decryption request handling from async
In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We...
RHEL 8 : kernel (RHSA-2025:21667)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21667 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: nfsd: don't ignore the return...
Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-40983)
tipc: possible crash before doing decryption. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504584; scriptversion"1.2";...
HSEC-2023-0011 git-annex GPG decryption attack via compromised remote
git-annex GPG decryption attack via compromised remote A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's GPG key. This attack could be used to expose encrypted data that was never stored in git-annex. Daniel Dent discovered this...
CVE-2025-40176
In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tlsstrpmsghold fails Async decryption calls tlsstrpmsghold to create a clone of the input skb to hold references to the memory it uses. If we fail to allocate that clone, proceeding with...
