Yealink AVHub encryption issue vulnerability

Versions prior to Yealink AVHub 153.135.0.76, Yealink UVC86 151.435.0.66, Yealink SmartVision 80 321.435.0.86, Yealink UVC40 E2 319.410.0.66, Yealink MeetingBorard C 328.321.0.40, Yealink MeetingBar A10 278.320.0.86, Yealink MeetingBar A40 289.320.0.81, and Yealink MeetingBar A50 323.320.0.54...

Social Insurance Institution Płatnik encryption issue vulnerability

The Social Insurance Institution Payout System versions 10.02.002 and earlier contain an encryption vulnerability. This vulnerability arises from downloading updates, libraries, and support files via HTTP, potentially enabling man-in-the-middle attacks that allow attackers to intercept transmitte...

IBM Langflow OSS encryption issue vulnerability

Versions 1.0.0 through 1.12.4 of IBM Langflow OSS contain an encryption vulnerability. This vulnerability arises because sensitive information is stored in plaintext, potentially allowing remote authenticated attackers to obtain such information...

DigitalBazaar Forge encryption issue vulnerability

Versions of DigitalBazaar Forge prior to 1.4.1 contain an encryption vulnerability. This vulnerability arises because X.509 CA certificates lacking the keyUsage extension fail to enforce basicConstraints.pathLenConstraint. As a result, attackers can craft certificate chains that exceed the declar...

QNAP HBS 3 Hybrid Backup Sync encryption issue vulnerability

Versions prior to 26.4.0.521 of QNAP HBS 3 Hybrid Backup Sync, versions prior to 26.4.0.521 of Hybrid Backup Sync 26.4.0.521, and versions prior to 26.4.1.563 of Hybrid Backup Sync 26.4.1 contain an encryption vulnerability stemming from the use of a hard-coded encryption key. This vulnerability...

Safir encryption issue vulnerability in the National Accounting Office

The KRAI Krajowa Izba Rozliczeniowa version 2.0 and earlier contain an encryption vulnerability stemming from the failure to perform certificate and hostname validation. This allows arbitrary client or server certificates to be accepted, potentially enabling attackers to supply any SSL/TLS...

QNAP HBS 3 Hybrid Backup Sync encryption issue vulnerability

Versions prior to 26.4.0.521 of QNAP HBS 3 Hybrid Backup Sync, versions prior to 26.4.0.521 of Hybrid Backup Sync 26.4.0.521, and versions prior to 26.4.1.563 of Hybrid Backup Sync 26.4.1 contain an encryption vulnerability. This vulnerability stems from the use of a hard-coded encryption key,...

KaringX clashmi encryption issue vulnerability

Versions KaringX clashmi 1.0.32.1801 and earlier contain an encryption vulnerability. This vulnerability stems from the default disabling of TLS certificate validation within the HttpUtils helper program. Attackers can exploit this by providing any certificate to intercept HTTPS traffic. They can...

OpenBSD LibreSSL encryption issue vulnerability

OpenBSD LibreSSL versions 4.4.0 and earlier contain an encryption vulnerability. This vulnerability arises because url2host discards the OCSP URL scheme, and httpalloc selects TLS only for port 443, resulting in plaintext transmission. Network attackers can read the OCSP request sent to the URL o...

MONAI MONAI encryption issue vulnerability

Versions of MONAI prior to 1.6.1 contain an encryption vulnerability stemming from insufficient integrity validation in checkhash. When hashval is None, it silently returns True and defaults to using MD5 hashing. Attackers can exploit this to perform man-in-the-middle attacks or registry tamperin...

Florent Clairambault ftpserverlib encryption issue vulnerability

Florent Clairambault ftpserverlib versions 0.32.4 and earlier contain an encryption vulnerability. This vulnerability arises because TransferOpen only checks the transferTLS flag set by PROT; it fails to verify whether the prepared data connection utilizes TLS. When a client sends a PROT P after...

SuperMicro MBD-X12SPI encryption issue vulnerability

The SuperMicro MBD-X12SPI version 01.07.20 contains an encryption vulnerability. This vulnerability arises because the HTML5 KVM-over-IP console uses tokens returned via its web interface for authentication; however, there is a weakness in token generation. As a result, attackers may guess sessio...

HCL Domino Server encryption issue vulnerability

Versions 2.0.2 FP8 and earlier, 14.0 FP5 and earlier, version 14.5, and 14.5.1 FP1 and earlier of HCL Domino Server contain an encryption vulnerability. This vulnerability arises from the leakage of private keys for eight eMudhra intermediate CA certificates, affecting certificate trust for...

Moxa OnCell G3150A-LTE Series encryption issue vulnerability

The Moxa OnCell G3150A-LTE Series version 1.0.0 contains an encryption vulnerability. This vulnerability stems from the presence of a hard-coded encryption key; unauthenticated remote attackers can obtain this shared encryption key material and impersonate affected devices that have not...

HCL Notes Client encryption issue vulnerability

Versions 2.0.2 FP8 and earlier, 14.0 FP5 and earlier, version 14.5, and 14.5.1 FP1 and earlier of HCL Notes Client contain an encryption vulnerability. This vulnerability stems from the leakage of the private keys for eight eMudhra intermediate CA certificates, affecting certificate trust for...

Eaton easysoft encryption issue vulnerability

Versions of Eaton EasySoft prior to 8.46 contain an encryption vulnerability. This vulnerability stems from improper validation of TLS certificates provided by the easyE4 device, potentially allowing network-neighboring attackers to perform man-in-the-middle attacks and intercept or modify...

Andrew Bennett JOSE encryption issue vulnerability

Versions of JOSE from 1.10.0 up to and including 1.11.13 contain an encryption vulnerability. This vulnerability arises from the use of a password hash with insufficient computational effort; when exporting the encrypted private key, it hardcodes 2048 iterations of PBKDF2-HMAC-SHA256 and an 8-byt...

OctoPrint encryption issue vulnerability

Versions 1.0.0 and 1.1.0 of OctoPrint contain an encryption vulnerability. This vulnerability arises because the Flask Secret Key Handler component utilizes a hard-coded encryption key, potentially allowing remote attackers to exploit this key...

Johnson Controls Kantech Entrapass encryption issue vulnerability

Versions of Johnson Controls Kantech Entrapass prior to 9.20 contain an encryption vulnerability. This vulnerability arises because sensitive information is stored in plain text in memory, potentially allowing attackers to retrieve embedded confidential data...

Forescout Technologies SecureConnector encryption issue vulnerability

Forescout Technologies SecureConnector versions 11.3.20 and earlier contain an encryption vulnerability. This vulnerability arises when the “Additional Appliance Connections” setting is enabled and the proxy configuration file contains more than three entries for trusted servers; in such cases,...