CVE-2025-24904 libsignal-service-rs doesn't sanity check plaintext envelopes are not sanity-checked

libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, plaintext content envelopes could be injected by a server or a malicious client, and m...

CVE-2025-24904

CVE-2025-24904 affects libsignal-service-rs, a Rust port of libsignal-service-java. Before commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, plaintext content envelopes could be injected by a server or malicious client, potentially bypassing end-to-end encryption and authentication. The fix is in ...

CVE-2025-24904 libsignal-service-rs doesn't sanity check plaintext envelopes are not sanity-checked

libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, plaintext content envelopes could be injected by a server or a malicious client, and m...

CVE-2025-24904 libsignal-service-rs doesn't sanity check plaintext envelopes are not sanity-checked

libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, plaintext content envelopes could be injected by a server or a malicious client, and m...

CVE-2024-54089

A vulnerability has been identified in APOGEE PXC Series BACnet All versions, APOGEE PXC Series P2 Ethernet All versions, TALON TC Series BACnet All versions. Affected devices contain a weak encryption mechanism based on a hard-coded key. This could allow an attacker to guess or decrypt the...

Missing Encryption Of Sensitive Data

@coinbase/wallet-sdk is vulnerable to Missing Encryption of Sensitive Data. The vulnerability is due to the use of outdated versions due to an unspecified security flaw that does not directly impact users' keys, smart contracts, or funds...

libsignal-service-rs 注入漏洞

libsignal-service-rs is a libsignal service open-sourced by Whisperfish for communicating with Signal servers. An injection vulnerability exists in libsignal-service-rs that stems from not properly validating the encryption state of the content envelope, allowing for plaintext injection...

PT-2025-6497 · Brocade · Brocade Sannav +1

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.1b Description: The issue allows an attacker to read the Brocade SANnav data stream, which includes monitored Brocade Fabric OS switches performance data, port status, zoning information, WWNs, and IP...

PT-2025-6828 · Schneider Electric · Asco 5310 Single-Channel Remote Annunciator

Name of the Vulnerable Software and Affected Versions: Schneider Electric - ASCO 5310 Single-Channel Remote Annunciator versions all Description: A Cleartext Transmission of Sensitive Information issue exists, potentially exposing data when network traffic is being intercepted by an attacker. Thi...

Brocade SANnav encryption key is logged in the debug logs (CVE-2025-1053)

Under certain error conditions at time of Brocade SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Broca...

GHSA-Q9W6-CWJ4-GF4P Unencrypted transmission in Temporal api-go library

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data...

CVE-2025-1243

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data...

CVE-2025-1243 Field in api-go proxy not transformed before version 1.44.1

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data...

CVE-2025-1243 Field in api-go proxy not transformed before version 1.44.1

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data...

CVE-2025-1243

Temporal api-go library prior to v1.44.1 fails to send update response data to Data Converter when used in a gRPC proxy during UpdateWorkflowExecution, causing incomplete Data Converter transformations (e.g., encryption) on the update response field. This occurs only when using the UpdateWorkflow...

CVE-2025-1243 Field in api-go proxy not transformed before version 1.44.1

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data...

CVE-2024-33504

A use of hard-coded cryptographic key to encrypt sensitive data vulnerability CWE-321 in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9, 7.0 all versions, 6.4 all versions may allow an attacker with JSON API access permissions to decrypt some secrets even if the...

CVE-2024-33504

A use of hard-coded cryptographic key to encrypt sensitive data vulnerability CWE-321 in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9, 7.0 all versions, 6.4 all versions may allow an attacker with JSON API access permissions to decrypt some secrets even if the...

Trusted Execution Environments

Really good--and detailed--survey of Trusted Execution Environments TEEs...

CVE-2024-54089

A vulnerability has been identified in APOGEE PXC Series BACnet All versions, APOGEE PXC Series P2 Ethernet All versions, TALON TC Series BACnet All versions. Affected devices contain a weak encryption mechanism based on a hard-coded key. This could allow an attacker to guess or decrypt the...