CVE-2016-1404

CVE-2016-1404 affects Cisco UCS Invicta software, including Invicta 4.3, 4.5, and 5.0.1 on Invicta appliances and Invicta Scaling System. The root cause is a single hardcoded GnuPG encryption key used across different customer installations, enabling remote attackers to defeat cryptographic prote...

CVE-2016-2333

SysLINK SL-1000 Machine-to-Machine M2M Modular Gateway devices with firmware before 01A.8 use the same hardcoded encryption key across different customers' installations, which allows attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another...

CVE-2016-2333

SysLINK SL-1000 Machine-to-Machine M2M Modular Gateway devices with firmware before 01A.8 use the same hardcoded encryption key across different customers' installations, which allows attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another...

CVE-2016-2333

The CVE-2016-2333 issue affects the SysLINK SL-1000 M2M Modular Gateway family, with firmware prior to 01A.8, where a single hard-coded cryptographic key is reused across different installations. This flaw can allow an attacker with knowledge of the key to defeat cryptographic protections, potent...

BlackBerry CEO Defends Lawful Access Principles, Supports Phone Hack

BlackBerry’s CEO made the company’s stance on lawful access requests clear this week and is defending actions to provide Canadian law enforcement with what it needed to decrypt communications between devices. The company’s CEO John Chen penned a statement on Monday, reiterating that one of...

Cisco Unified Communications Manager Information Disclosure Vulnerability (cisco-sa-20160208-ucm)

Cisco Unified Communications Manager CUCM is prone to an information disclosure vulnerability. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-lat...

CVE-2016-1319

Cisco Unified Communications Manager aka CallManager 9.12.10000.28, 10.52.10000.5, 10.52.12901.1, and 11.01.10000.10; Unified Communications Manager IM & Presence Service 10.52; Unified Contact Center Express 11.01; and Unity Connection 10.52 store a cleartext encryption key, which allows local...

Code injection

Cisco Unified Communications Manager aka CallManager 9.12.10000.28, 10.52.10000.5, 10.52.12901.1, and 11.01.10000.10; Unified Communications Manager IM & Presence Service 10.52; Unified Contact Center Express 11.01; and Unity Connection 10.52 store a cleartext encryption key, which allows local...

CVE-2016-1319

Cisco Unified Communications Manager aka CallManager 9.12.10000.28, 10.52.10000.5, 10.52.12901.1, and 11.01.10000.10; Unified Communications Manager IM & Presence Service 10.52; Unified Contact Center Express 11.01; and Unity Connection 10.52 store a cleartext encryption key, which allows local...

CVE-2016-1319

CVE-2016-1319 concerns Cisco Unified Communications Manager and related products (CUCM, IM&P, UCCX, Unity Connection) that store a cleartext encryption key, enabling local users to obtain sensitive information via unspecified vectors. Root cause is improper key management allowing plaintext key e...

CVE-2015-6414

Cisco TelePresence Video Communication Server (VCS) X8.6 uses a single encryption key shared across different customer installations, enabling a local attacker who knows a key from another installation to bypass cryptographic protections and potentially read sensitive data. This vulnerability ste...

Use Padding Oracle attacks to obtain the encrypted key-vulnerability warning-the black bar safety net

0×0 0 Preface In this article I want to share some of the use of the padding oracle vulnerability practical tips, this type of vulnerability allows an attacker to decrypt the ciphertext and the encrypted plaintext. About the padding oracle attack concept and the working principle of the more...

Fewer IPsec VPN Connections at Risk to Weak Diffie-Hellman

A challenge has been made against one of the conclusions in a potentially blockbuster academic paper on cryptographic weaknesses that may be the open door through which intelligence agencies are breaking encrypted connections. The paper, “Imperfect Forward Secrecy: How Diffie-Hellman Fails in...

Magento E-Commerce Platform Magmi Plugin Information Disclosure

An information disclosure vulnerability has been discovered in Magento e-commerce platform Magmi Plugin. Successful exploitation results in access to Magento site credentials and database encryption key...

SAP Fixes A Dozen Vulnerabilities in HANA

SAP patched a dozen holes in its in-memory management system, HANA, that could have led to SQL injection attacks, cross-site scripting XSS errors, and memory corruption vulnerabilities. Many of the bugs were addressed by the company months ago, but it wasn’t until Tuesday that Onapsis, the securi...

SAP Afaria product exposed a series of serious vulnerabilities that affect a large number of mobile device-bug warning-the black bar safety net

Afaria is the German SAP software company developed a mobile device management MDM solutions that are currently on the market the most popular MDM solutions, there are about 6 3 0 0 a enterprise which manages 1 billion 3 0 0 million of the mobile device. ERPScan is specifically responsible for th...

QNAP Logging Error Encryption Key Vulnerability

NAP Turbo NAS Series Devices is a storage device with software support for real-time backup, data synchronization and scheduled backup. NAP Turbo NAS Series Devices has a security vulnerability where the syslog encryption key is logged to an unencrypted hard disk partition and is globally readabl...

Script Kiddies can Now Create their Own Ransomware using This Kit

Don't panic! You heard it right. A Turkish security researcher named Utku Sen has posted a fully functional Ransomware code on open source code sharing website GitHub. The Ransomware dubbed Hidden Tear, uses AES Encryption to lock down files before displaying a ransom message warning to get users...

SAP HANA system exposed to security vulnerabilities, static key exists in the database-vulnerability warning-the black bar safety net

! SAP is well-known in-memory database management system HANA was traced to the presence of security vulnerabilities, static encryption key is actually stored in the database. SAP HANA is SAP ever the fastest-growing products. Vulnerability overview ERPScan researchers held in Amsterdam the black...

Toshiba CHEC Built-in Encryption Key Information Disclosure Vulnerability

Toshiba CHEC is a product of Toshiba Corporation. Toshiba CHEC has a security vulnerability due to the inclusion of a built-in encryption key in the CreateBossCredentials.jar file. This allows an attacker with access to bossinfo.pro to decrypt content, including BOSS database information, using t...