Input buffer over-read in AES-XTS implementation on 64 bit ARM

Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The...

CBL Mariner 2.0 Security Update: m2crypto (CVE-2020-25657)

The version of m2crypto installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-25657 advisory. - A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing...

Fedora 36 : gnutls / guile-gnutls (2023-4fc4c33f2b)

The remote Fedora 36 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-4fc4c33f2b advisory. Release of gnutls 3.8.0 fixes CVE-2023-0361 Release of gnutls guile bingings as standalone package. Tenable has extracted the preceding description block...

Ransomware attack hits ANOTHER school

In what is likely Vice Society's handiwork, the UK's largest state boarding school Wymondham College has announced it has become the victim of a "sophisticated cyberattack". The school didn't provide additional information, but Jonathan Taylor, chief of the school's parent company Sapientia...

gnutls: timing side-channel in the TLS RSA key exchange code

A timing side-channel vulnerability was found in RSA ClientKeyExchange messages in GnuTLS. This side-channel may be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption, the attacker would need to send ...

openssl: timing attack in RSA Decryption implementation

A timing-based side channel exists in the OpenSSL RSA Decryption implementation, which could be sufficient to recover a ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption, an attacker would have to be able to send a very large number of trial messages...

RHEL 9 : openssl (RHSA-2023:1199)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1199 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

PT-2023-1940

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.15.0 and earlier Description The issue is related to the use of a weak encryption mechanism in Adobe Experience Manager, which can be exploited by a remote attacker to disclose protected information. A...

CVE-2023-0353

Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypted passwords to be decrypted from the configuration file...

Hardcoded credentials

Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypted passwords to be decrypted from the configuration file...

CVE-2023-0353 CVE-2023-0353

Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypted passwords to be decrypted from the configuration file...

CVE-2023-0353

The connected documentation confirms CVE-2023-0353 affects Akuvox E11. The vulnerability arises from storing passwords with a weak encryption algorithm and decrypting them via a hard-coded key, enabling potential decryption of encrypted passwords from the device configuration. Impact is rated hig...

K000132943: OpenSSL vulnerability CVE-2022-4304

Security Advisory Description A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very lar...

AlmaLinux 9 : gnutls (ALSA-2023:1141)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:1141 advisory. - A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypte...

CVE-2023-0353: Undefined Security Weakness

Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypted passwords to be decrypted from the configuration file...

PT-2023-16205

Name of the Vulnerable Software and Affected Versions Akuvox E11 affected versions not specified Description The issue concerns the use of a weak encryption algorithm for stored passwords and a hard-coded password for decryption. This could allow the encrypted passwords to be decrypted from the...

CVE-2023-0355: Undefined Security Weakness

Akuvox E11 uses a hard-coded cryptographic key, which could allow an attacker to decrypt sensitive information...

SUSE SLES12: libopenssl-devel / libopenssl1_0_0 / libopenssl1_0_0-32bit / etc (SUSE-SU-2023:0684-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0684-1 advisory. - CVE-2023-0286: Fixed X.400 address type confusion in X.509 GeneralNameFixed bsc1207533. - CVE-2023-0215: Fixed a use-after-free following...

Akuvox E11 security feature vulnerability

Akuvox E11 is a SIP visual doorbell from Akuvox designed for villas, houses and apartments. A security vulnerability exists in Akuvox E11 that stems from the inclusion of a feature that encrypts a message and then forwards it.The IV vector and key are static, which could allow an attacker to...

SUSE-SU-2023:0684-1 Security update for openssl

This update for openssl fixes the following issues: - CVE-2023-0286: Fixed X.400 address type confusion in X.509 GeneralNameFixed bsc1207533. - CVE-2023-0215: Fixed a use-after-free following BIOnewNDEF bsc1207536. - CVE-2022-4304: Fixed a timing oracle in RSA decryption bsc1207534. The following...