HomeGallery 安全漏洞

HomeGallery is a self-hosted open source web gallery from HomeGallery Open Source. It is used for browsing tagged, mobile-friendly, and AI-driven image discovery. A security vulnerability exists in HomeGallery version 1.15.0 and prior versions, which stems from default settings that do not have T...

IBM Aspera Faspex Encryption Problem Vulnerability (CNVD-2024-49165)

IBM Aspera Faspex is an International Business Machines IBM solution for rapid global person-to-person document delivery and collaboration. IBM Aspera Faspex has an encryption issue vulnerability that stems from improper encryption of certain data. An attacker could exploit the vulnerability to...

Acronis Cyber Protect Cloud Agent 加密问题漏洞

Acronis Cyber Protect Cloud Agent is a cloud agent from Acronis Switzerland. An encryption issue vulnerability exists in versions prior to Acronis Cyber Protect Cloud Agent build39185 that stems from a weak algorithm used to sign RPM packages...

SUSE CVE-2020-8912

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...

IBM Security Guardium Key Lifecycle Manager Log Information Disclosure Vulnerability

IBM Security Guardium Key Lifecycle Manager is an encryption key management tool from International Business Machines IBM. It centralizes, simplifies and automates the key management process. IBM Security Guardium Key Lifecycle Manager suffers from a log information disclosure vulnerability that...

TP-LINK WR845N Weak Encryption Vulnerability

The TP-LINK WR845N is a wireless router from China P&L TP-LINK. A weak encryption vulnerability exists in the TP-LINK WR845N version V4190219, which originates from transmitting credentials in base64 encoded form, and can be exploited by an attacker to easily decode them via a man-in-the-middle...

IBM Security Guardium Key Lifecycle Manager Information Disclosure Vulnerability (CNVD-2025-01797)

IBM Security Guardium Key Lifecycle Manager is an encryption key management tool from International Business Machines IBM. It centralizes, simplifies and automates the key management process. IBM Security Guardium Key Lifecycle Manager suffers from an information disclosure vulnerability that ste...

CVE-2023-7005

A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilized to compromise the lock, such as through revealing the unlockKey field...

CVE-2023-7005

CVE-2023-7005 affects the TTLock ecosystem (TTLock App and Sciener firmware components) with a flaw where a specially crafted message to the TTLock App downgrades the cryptographic protocol used for communication and can disclose the unlockKey. The vulnerability is tied to how the app/lock pairin...

CVE-2023-7005 CVE-2023-7005

A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilized to compromise the lock, such as through revealing the unlockKey field...

CVE-2023-7005 CVE-2023-7005

A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilized to compromise the lock, such as through revealing the unlockKey field...

CVE-2024-56128

A flaw was found in Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM, which did not fully adhere to the requirements of RFC 5802. Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the...

IBM Cognos Analytics Mobile 安全漏洞

IBM Cognos Analytics Mobile is an application from International Business Machines IBM, Inc. integrates reporting, modeling, analytics, dashboards, cases, and event management. A security vulnerability exists in IBM Cognos Analytics Mobile version 1.1.14 that stems from the use of...

Weasis Key Disclosure Vulnerability

Weasis is an open source DICOM medical image viewer, mainly used to visualize images obtained from medical imaging devices. A key disclosure vulnerability exists in Weasis version 4.5.1, which stems from having a hard-coded key for symmetric encryption of proxy credentials in...

NotLockBit: A Deep Dive Into the New Ransomware Threat

Overview NotLockBit is a new and emerging ransomware family that actively mimics the behavior and tactics of the well-known LockBit ransomware. It distinguishes itself by being one of the first fully functional ransomware strains to target macOS and Windows systems. Distributed as an x8664 golang...

Apache Kafka's SCRAM implementation Incorrectly Implements Authentication Algorithm

Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM did not fully adhere to the requirements of RFC 5802 1. Specifically, as per RFC 5802, the serv...

CVE-2024-56128

Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM did not fully adhere to the requirements of RFC 5802 1. Specifically, as per RFC 5802, the serv...

CVE-2024-56128 Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption

Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM did not fully adhere to the requirements of RFC 5802 1. Specifically, as per RFC 5802, the serv...

CVE-2024-56128 Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption

Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM did not fully adhere to the requirements of RFC 5802 1. Specifically, as per RFC 5802, the serv...

CVE-2024-56128

CVE-2024-56128 affects Apache Kafka SCRAM authentication. Root cause: SCRAM server nonce verification against the server’s first message was not performed per RFC 5802, enabling plaintext-snooping scenarios if SCRAM is used over non-TLS. Impact: exploitation requires access to plaintext SCRAM exc...