PT-2015-5293

Name of the Vulnerable Software and Affected Versions FortiClient version 5.2.3.091 Description The issue concerns the use of a hardcoded encryption key in the qm class, which can be leveraged by attackers to decrypt sensitive data, including passwords, stored in the Shared Preferences...

The Hang Seng JRES platform registration vulnerability, you can hack the registry-the vulnerability warning-the black bar safety net

! plugin.jpg The eclipse-jres\plugins\com. hundsun. ares. studio. jres. register1. 1. 0. 2 0 1 2 0 8 2 9 1 4 0 8. jar to decompile,according to the com\hundsun\ares\studio\jres\register\RegisterUtil. the java file can get the registration file of the encryption way and key. The eclipse-jres\keys...

Mac EFI is exposed a major security vulnerability by Thunderbolt devices to spread malicious programs-vulnerability warning-the black bar safety net

Next week, Germany at the Chaos Communication Congress Security Conference, a researcher Trammell Hudson will present a new method, through the unique production of Thunderbolt devices in the Mac EFI boot firmware in the injection almost impossible to not remove the Bootkit virus. The exploits of...

NSA-Approved Samsung Knox Stores PIN in Cleartext

A security researcher has tossed a giant bucket of ice water on Samsung’s thumbs up from the NSA approving use of certain Galaxy devices within in the agency. The NSA’s blessing, given under the agency’s Commercial Solutions for Classified Program, meant that the Samsung Galaxy 4, 5 and Galaxy No...

CVE-2014-4448: Undefined Security Weakness

House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID...

CVE-2014-6283

SAP Adaptive Server Enterprise ASE 15.7 before SP122 or SP63, 15.5 before ESD5.4, and 15.0.3 before ESD4.4 does not properly restrict access, which allows remote authenticated database users to 1 overwrite the master encryption key or 2 trigger a buffer overflow via a crafted RPC message to the...

Buffer overflow

SAP Adaptive Server Enterprise ASE 15.7 before SP122 or SP63, 15.5 before ESD5.4, and 15.0.3 before ESD4.4 does not properly restrict access, which allows remote authenticated database users to 1 overwrite the master encryption key or 2 trigger a buffer overflow via a crafted RPC message to the...

CVE-2014-6283

SAP Adaptive Server Enterprise ASE 15.7 before SP122 or SP63, 15.5 before ESD5.4, and 15.0.3 before ESD4.4 does not properly restrict access, which allows remote authenticated database users to 1 overwrite the master encryption key or 2 trigger a buffer overflow via a crafted RPC message to the...

CVE-2014-6283: Undefined Security Weakness

SAP Adaptive Server Enterprise ASE 15.7 before SP122 or SP63, 15.5 before ESD5.4, and 15.0.3 before ESD4.4 does not properly restrict access, which allows remote authenticated database users to 1 overwrite the master encryption key or 2 trigger a buffer overflow via a crafted RPC message to the...

PT-2014-7130

Name of the Vulnerable Software and Affected Versions SAP Adaptive Server Enterprise ASE versions 15.0.3 before ESD4.4 SAP Adaptive Server Enterprise ASE versions 15.5 before ESD5.4 SAP Adaptive Server Enterprise ASE versions 15.7 before SP122 or SP63 Description The issue allows remote...

SEC Consult SA-20140710-1 :: Multiple high risk vulnerabilities in Shopizer webshop

SEC Consult Vulnerability Lab Security Advisory 20140710-1 ======================================================================= title: Multiple high risk vulnerabilities in Shopizer webshop product: Shopizer vulnerable version: 1.1.5 and below fixed version: v2 new codebase impact: high...

Siemens Patches Five Vulnerabilities in SIMATIC WinCC for PCS 7

Siemens has patched five vulnerabilities in its SIMATIC PCS 7 system that could result in privilege escalation and give an attacker unauthenticated access to sensitive data. The flaws technically exist in WinCC, a SCADA supervisory control and data acquisition and HMI human-machine interface syst...

PT-2014-1969

Name of the Vulnerable Software and Affected Versions Seagate Business NAS devices with firmware before 2015.00322 Description The issue is caused by the use of defective or risky cryptographic algorithms in the embedded software of Business NAS devices, allowing remote attackers to execute...

CVE-2014-4686

The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during...

CVE-2014-4686: Undefined Security Weakness

The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during...

Shopizer 1.1.5 Authorization Bypass / Hardcoded Key

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple high risk vulnerabilities in Shopizer webshop product: Shopizer vulnerable version: 1.1.5 and below fixed version: v2 new codebase impact: high homepage:...

Mythic Entertainment Dark Age of Camelot 1.6x Encryption Key Signing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9960/info An encryption key signing vulnerability has been reported to exist in Dark Age of Camelot. This issue is due to a design error in the application that carries out encryption without having the encryption key...

Digipass Go3 Insecure Encryption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/21040/info Digipass Go3 is prone to an insecure-encryption vulnerability because the device uses an insecure encryption algorithm to encrypt sensitive data. An attacker can exploit this issue to brute-force the encryption...

No-CMS 0.6.6 rev 1 - Admin Account Hijacking / RCE Exploit via Static Encryption Key

No description provided by source. ?php / Static encryptionkey of No-CMS lead to Session Array Injection in order to hijack administrator account then you will be able for upload php files to server via theme/module upload. This exploit generates cookie for administrator access from non-privilege...

CodeIgniter / Kohana PHP Object Injection / Timing Attack

CodeIgniter versions 2.1.4 and below and Kohana versions 3.2.3 and below and 3.3.2 and below suffer from PHP object injection, a timing attack, and a remote code execution vulnerability. Background info and boring history shit:...