Dell Client Platform 安全漏洞

Dell Client Platform is a client platform from Dell USA. A security vulnerability exists in the Dell Client Platform BIOS that stems from the use of a default encryption key. An attacker could exploit the vulnerability to execute arbitrary code...

Siemens Mendix 安全漏洞

The Mendix Encryption module takes care of the following encryption requirements: plain text encryption e.g. passwords and FileDocument encryption e.g. documents or photos. A hard-coded default encryption key vulnerability exists in the Siemens Mendix Encryption module, which can be exploited by ...

Baxter Welch Ally Connex Spot Monitor Security Vulnerability

Baxter Welch Ally Connex Spot Monitor is a monitor from Baxter, Inc. A security vulnerability exists in Baxter Welch Ally Connex Spot Monitor versions prior to 1.52 that stems from the use of a default encryption key...

CVE-2024-29941

CVE-2024-29941 describes insecure storage of ICT MIFARE and DESFire encryption keys in the firmware binary, enabling credential cloning by creating credentials for any site code and card number that uses the default ICT encryption. The Red Hat/NVD entries corroborate that the issue arises from st...

CVE-2023-34258

An issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely queried. This configuration contains the Patrol account password, encrypted with a default AES key. This account can then be used to achieve remote code execution...

PT-2023-24780 · Bmc · Bmc Patrol

Name of the Vulnerable Software and Affected Versions: BMC Patrol versions prior to 22.1.00 Description: An issue was discovered where the agent's configuration can be remotely queried, containing the Patrol account password encrypted with a default AES key. This account can then be used to achie...

CVE-2021-40342 Use of default key for encryption

In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected products versions. This issue affects FOXMAN-UN product:...

The vulnerability of the “Remember Me” function implementation in the Apache Shiro framework allows a hacker to execute arbitrary code or bypass security restrictions.

The vulnerability of the “Remember Me” function implementation in the Apache Shiro framework is related to the use of the default encryption key. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or bypass security restrictions remotely...

Nextcloud Server File Block Overwrite Vulnerability (NC-SA-2020-038)

Nextcloud Server is prone to a vulnerability where Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and...

Facebook Announces Messenger Security Features that Don't Compromise Privacy

Note that this is "announced," so we don't know when it's actually going to be implemented. Facebook today announced new features for Messenger that will alert you when messages appear to come from financial scammers or potential child abusers, displaying warnings in the Messenger app that provid...

CVE-2020-5248

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data mu...

CVE-2020-5248

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data mu...

CVE-2019-19127

An authentication bypass vulnerability is present in the standalone SITS:Vision 9.7.0 component of Tribal SITS in its default configuration, related to unencrypted communications sent by the client each time it is launched. This occurs because the Uniface TLS Driver is not enabled by default. Thi...

S3Tk - A Security Toolkit For Amazon S3

A security toolkit for Amazon S3 Another day, another leaky Amazon S3 bucket — The Register, 12 Jul 2017 Don’t be the... next... big... data... leak Battle-tested at Instacart Installation Run: pip install s3tk You can use the AWS CLI to set up your AWS credentials: pip install awscli aws configu...

Multiple Huawei products encryption issues vulnerabilities

The Huawei S12700, among others, is an enterprise switch product from Huawei, a Chinese company. An encryption vulnerability exists in several Huawei products. The vulnerability stems from a weak encryption algorithm used by the product by default, which can be exploited by an attacker to disclos...

Primetek Primefaces Weak Encryption Remote Code Execution (CVE-2017-1000486)

Primefaces versions prior to 5.2.21, 5.3.8 or 6.0 are vulnerable to a padding oracle attack, due to the use of weak crypto and default encryption password...

DEBIAN-CVE-2016-0736

In Apache HTTP Server versions 2.4.0 to 2.4.23, modsessioncrypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation AES256-CBC by default, hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle...

CVE-2016-2951

IBM BigFix Remote Control before 9.1.3 does not properly set the default encryption strength, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and performing calculations on encrypted data...

CVE-2016-2951

IBM BigFix Remote Control before 9.1.3 does not properly set the default encryption strength, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and performing calculations on encrypted data...

OpenAFS Multiple Vulnerabilities - 01 - Windows

OpenAFS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openafs:openafs"; ifdescription...