1519 matches found
CVE-2022-23724 PingID Integration for Windows Login MFA Bypass
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials...
Automation 360 信任管理问题漏洞
Automation 360 is a cloud-native end-to-end intelligent automation platform. A security vulnerability exists in Automation 360 version 22 that stems from a hard-coded encryption key that can decrypt exported RPA packages...
The vulnerability of the SSL-VPN portal for FortiOS operating systems allows a hacker to obtain the encryption key.
The vulnerability of the SSL-VPN portal for FortiOS operating systems is related to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability could allow a malicious actor to obtain the encryption key remotely...
Security Bulletin: IBM Watson Knowledge Catalog (with Information Server) is affected by a Cryptographic vulnerability
Summary A Cryptographic vulnerability was addressed by IBM Watson Knowledge Catalog with Information Server. Vulnerability Details CVEID: CVE-2019-4220 DESCRIPTION: IBM InfoSphere Information Server stores a common hard coded encryption key that could be used to decrypt sensitive information. CVS...
Default credentials
RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were used...
CVE-2022-26660
RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were used...
CVE-2022-26660
CVE-2022-26660 affects RunAsSpc 4.0. The root cause is a universal and recoverable encryption key used to protect credentials, enabling the recovery of credentials from a file encrypted by RunAsSpc. Impact stated: an attacker who gains access to an encrypted RunAsSpc file can recover the credenti...
Authentication flaw
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would...
Authentication flaw
Fresenius Kabi Vigilant Software Suite Mastermed Dashboard version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitrary users...
CVE-2021-33846 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm
Fresenius Kabi Vigilant Software Suite Mastermed Dashboard version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitrary users...
CVE-2021-33846
CVE-2021-33846 affects Fresenius Kabi Vigilant Software Suite MasterMed Dashboard (v2.0.1.3). The vulnerability arises because authentication tokens issued to authenticated users are signed with a symmetric encryption key, enabling an attacker possessing the key to issue valid JWTs and impersonat...
Dell PowerPath Management Appliance安全漏洞
The DELL Dell PowerPath Management Appliance is a PowerPath host management application from Dell USA that offers two models: a virtual machine-based appliance and a Docker containerized appliance. A security vulnerability exists in the Dell PowerPath Management Appliance, which can be exploited ...
The vulnerability of the “Remember Me” function implementation in the Apache Shiro framework allows a hacker to execute arbitrary code or bypass security restrictions.
The vulnerability of the “Remember Me” function implementation in the Apache Shiro framework is related to the use of the default encryption key. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or bypass security restrictions remotely...
Dell EMC CloudLink 安全漏洞
Dell EMC CloudLink is a flexible data encryption and key management solution for data encryption in public, private, and hybrid cloud environments.Dell EMC CloudLink 7.1 and earlier versions contain an arbitrary file creation vulnerability that can be exploited by remote unauthenticated attackers...
Information disclosure
An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtain the encryption key used to decrypt firmware update packages...
CVE-2021-3789
An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtain the encryption key used to decrypt firmware update packages...
CVE-2021-3789
CVE-2021-3789 affects some Motorola‑branded Binatone Hubble Cameras. The root cause is an information disclosure that could allow a physically proximate attacker to obtain the encryption key used to decrypt firmware update packages. The vulnerability enables access to confidential keys, enabling ...
Cisco Business 220 Series Smart Switches 信任管理问题漏洞
Cisco Business 220 Series Smart Switches is a series of smart switches from Cisco, Inc. It is used to build reliable enterprise networks on a limited budget. A trust management issue vulnerability exists in the Cisco Business 220 Series Smart Switches firmware, which stems from the use of a stati...
The vulnerability of the repository for Trusted Platform Module tpm2-tools, related to the disclosure of information, allows a perpetrator to gain access to confidential data.
The vulnerability of the repository for Trusted Platform Module tpm2-tools is related to the use of a fixed AES key for internal encryption. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to confidential data...
