5776 matches found
PT-2019-6349 · 3S Smart · Codesys Control Rte V3 +12
Name of the Vulnerable Software and Affected Versions: 3S-Smart CODESYS V3 products versions containing the CmpUserMgr component CODESYS Control for BeagleBone versions containing the CmpUserMgr component CODESYS Control for emPC-A/iMX6 versions containing the CmpUserMgr component CODESYS Control...
PT-2019-11747 · Jenkins · Jenkins Gogs Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Gogs Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted form in job config.xml files on the Jenkins master or controller. These credentials can be accessed by users with...
MGASA-2019-0207 Updated microcode package fixes security vulnerability
Secure Encrypted Virtualization SEV on Advanced Micro DevicesAMD Platform Security Processor PSP; aka AMD Secure Processor or AMD-SP 0.17 build 11 and earlier has an insecure cryptographic implementation. This update provides Amd SEV Firmware to 0.17 build 22 CVE-2019-9836. It also updates the...
F5 BIG-IP Encryption Problem Vulnerability
F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. The F5 BIG-IP is vulnerable to an encryption issue. An attacker could exploit this vulnerability to decrypt encrypted...
Xpdf buffer overflow vulnerability (CNVD-2019-21463)
Xpdf is an open source PDF reader from Foo Labs. The product supports decoding LZW compressed format files and read encrypted PDF files. A buffer overflow vulnerability exists in the 'SplashXPath::strokeAdjust' function in the splash/SplashXPath.cc file in Xpdf version 4.01.01. The vulnerability...
CVE-2019-6632
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are encrypted because the vCMP configuration unit key is generated with insufficient randomness. The attack prerequisite is direct access to...
Google Releases Basic Homomorphic Encryption Tool
Google has released an open-source cryptographic tool: Private Join and Compute. From a Wired article: Private Join and Compute uses a 1970s methodology known as "commutative encryption" to allow data in the data sets to be encrypted with multiple keys, without it mattering which order the keys a...
AMD Secure Encrypted Virtualization (SEV) Key Recovery Vulnerability
AMD Secure Encrypted Virtualization SEV is a hardware memory encryption feature. SEV protects guest virtual machines from the hypervisor, provides confidentiality guarantees at runtime and remote attestation at launch time. The SEV elliptic-curve ECC implementation was found to be vulnerable to a...
Two Florida Cities Paid $1.1 Million to Ransomware Hackers This Month
In the last two weeks, Florida has paid more than $1.1 million in bitcoin to cybercriminals to recover encrypted files from two separate ransomware attacks—one against Riviera Beach and the other against Lake City. Lake City, a city in northern Florida, agreed on Monday to pay hackers 42 Bitcoin...
CVE-2019-9836
Secure Encrypted Virtualization SEV on Advanced Micro Devices AMD Platform Security Processor PSP; aka AMD Secure Processor or AMD-SP 0.17 build 11 and earlier has an insecure cryptographic implementation...
Google Releases Open Source Tool For Computational Privacy
Google is releasing a new open-source cryptographic tool aimed at boosting privacy around sensitive data sets. The tool, called Private Join and Compute, is designed to help companies who are working together with confidential data sets. Private Join and Compute, allows companies to share data in...
Debian DLA-1825-1 : kdepim security update
A reply-based decryption oracle was found in kdepim, which provides the KMail e-mail client. An attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline character...
The vulnerability of the command-line interface of the Cisco NX-OSS network operating system devices allows a attacker to obtain the user’s encrypted SSH key or import an encrypted SSH key protected by a password.
The vulnerability of the command-line interface of the Cisco NX-OSS network operating system is related to errors in managing SSH keys. Exploiting this vulnerability can allow an attacker to obtain a secret SSH key of a user or import a secret SSH key protected by a password...
Google's Push to Close a Major Encrypted Web Loophole
By building security into top-level domains, Google makes it harder for HTTPS to fall short...
Telegram Suffers 'Powerful DDoS Attack' From China During Hong Kong Protests
Telegram, one of the most popular encrypted messaging app, briefly went offline yesterday for hundreds of thousands of users worldwide after a powerful distributed denial-of-service DDoS attack hit its servers. Telegram founder Pavel Durov later revealed that the attack was mainly coming from the...
Telegram Suffers 'Powerful DDoS Attack' From China During Hong Kong Protests
Telegram, one of the most popular encrypted messaging app, briefly went offline yesterday for hundreds of thousands of users worldwide after a powerful distributed denial-of-service DDoS attack hit its servers. Telegram founder Pavel Durov later revealed that the attack was mainly coming from the...
CVE-2019-0307
Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to t...
Cloudera Navigator Key Trustee KMS Encryption Issue Vulnerability
Cloudera Navigator Key Trustee KMS is a customized secret key management server from Cloudera. A security vulnerability exists in Cloudera Navigator Key Trustee KMS versions 5.12 and 5.13. An attacker can exploit the vulnerability to recover previously deleted but not cleaned keys or delete the...
CVE-2018-20091
An SQL injection vulnerability was found in Cloudera Data Science Workbench CDSW 1.4.0 through 1.4.2. This would allow any authenticated user to run arbitrary queries against CDSW's internal database. The database contains user contact information, encrypted CDSW passwords in the case of local...
