Code injection

Philips e-Alert Unit non-medical device, Version R2.1 and prior. The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The Philips e-Alert communication channel is not encrypted which could therefore lead to...

Hardcoded credentials

Philips e-Alert Unit non-medical device, Version R2.1 and prior. The software contains hard-coded cryptographic key, which it uses for encryption of internal data...

Spoofing

The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entries in the Agent are not encrypted...

CVE-2017-13102 Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption

Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

[SECURITY] [DLA 1462-1] wpa security update

Package : wpa Version : 2.3-1+deb8u6 CVE ID : CVE-2018-14526 Debian Bug : 905739 The following vulnerability was discovered in wpasupplicant. CVE-2018-14526: | An issue was discovered in rsnsupp/wpa.c in wpasupplicant 2.0 | through 2.6. Under certain conditions, the integrity of EAPOL-Key |...

A large number of Bluetooth devices and systems will be protected by encryption Vulnerability CVE-2018-5383 impact-vulnerability warning-the black bar safety net

Recently, a security research expert in a certain Bluetooth device is found in a high-risk encryption Vulnerability CVE-2018-5383, and an unauthenticated attacker in physical proximity to the target device, this vulnerability will allow them to intercept, monitor or tamper with equipment of the...

UBUNTU-CVE-2018-12983

A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote attackers to cause a denial-of-service via a crafted pdf file...

Security Bulletin: Security vulnerability affects IBM® Rational® Team Concert

Summary IBM Rational Team Concert RTC is affected by a potential security vulnerability related to the usage of a broken or Risky Cryptographic Algorithm. Vulnerability Details CVEID: CVE-2017-1701 DESCRIPTION: IBM Team Concert RTC stores credentials for users using a weak encryption algorithm,...

Security Bulletin: IBM Security Access Manager Appliance is affected by an encryption vulnerability (CVE-2017-1473)

Summary IBM Security Access Manager Appliance has addressed the following weak encryption vulnerability. Vulnerability Details CVEID: CVE-2017-1473 DESCRIPTION: IBM Security Access Manager Appliance uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly...

Security Bulletin: Vulnerability in SSLv3 affects IBM Workload Deployer (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Workload Deployer. Vulnerability Details CVEID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

Security Bulletin: Vulnerability in SSLv3 affects WebSphere Lombardi Edition (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in WebSphere Lombardi Edition. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: WebSphere Lombardi Edition could allow a remote attacker t...

CVE-2018-8864

In ATI Systems Emergency Mass Notification Systems HPSS16, HPSS32, MHPSS, and ALERT4000 devices, a missing encryption of sensitive data vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms...

CVE-2018-8864

The CVE-2018-8864 entry applies to ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, ALERT4000). The vulnerability is caused by missing encryption of sensitive data in radio transmissions, enabling a remote attacker to trigger false alarms. Affected components are the comman...

S/MIME Information Disclosure Vulnerability

S/MIME is a certificate implementation for email encryption. A security vulnerability exists in S/MIME. An attacker could exploit the vulnerability to obtain a message in plaintext form from an encrypted message...

Here's How eFail Attack Works Against PGP and S/MIME Encrypted Emails

With a heavy heart, security researchers have early released the details of a set of vulnerabilities discovered in email clients for two widely used email encryption standards—PGP and S/MIME—after someone leaked their paper on the Internet, which was actually scheduled for tomorrow. PGP and S/MIM...

Hardcoded credentials

The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows is encrypted with a hard-coded cryptographic key, so anyone who knows that key and the algorithm can decrypt it. A low-privilege user could decrypt and modify the backup file in...

IBM BigFix Remote Control Encryption Issue Vulnerability (CNVD-2018-08559)

IBM BigFix Remote Control is a set of remote control systems from IBM in the United States. An encryption issue vulnerability exists in IBM BigFix Remote Control. A remote attacker could exploit this vulnerability by performing a man-in-the-middle attack to decrypt traffic...

CVE-2018-5261

Flexense DiskBoss 8.8.16 and earlier has a vulnerability where plaintext data from the handshake is used as input for the encryption key for the rest of the session, allowing a man-in-the-middle to access sensitive information such as authentication credentials. Source reports include NVD and CNV...

Hardcoded credentials

Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the...

CVE-2017-17910

The CVE-2017-17910 issue affects Hoermann BiSecur devices (HS5-868-BS, HSE1-868-BS, HSE2-868-BS) before 2018. A attacker can capture a single radio transmission to obtain the encrypted packet and a 32-bit serial number, then derive the encryption key due to AES-128 using a static IV and static da...