Silicon Labs Gecko SDK Security Vulnerability

The Silicon Labs Gecko SDK GSDK is an open source library from Silicon Labs. Combines the Silicon Labs Wireless Software Development Kit SDK and the Gecko platform into one integrated package. A security vulnerability exists in Silicon Labs Gecko SDK 4.4.0 and prior versions, which stems from a...

PT-2023-31578 · Unknown · Blinksocks

Name of the Vulnerable Software and Affected Versions: blinksocks version 3.3.8 Description: An issue was discovered in the component /presets/ssr-auth-chain.js, allowing remote attackers to obtain sensitive information via weak encryption algorithms. Recommendations: For blinksocks version 3.3.8...

CVE-2023-50481

CVE-2023-50481 affects blinksocks 3.3.8. The vulnerability is in the component /presets/ssr-auth-chain.js, due to the use of weak encryption algorithms (and fixed IVs) that can disclose sensitive information. Impact is described as sensitive information disclosure; no exploit details are provided...

The vulnerability of the ssh-agent agent in the OpenSSH encryption protection mechanism allows attackers to disclose the protected information.

The vulnerability of the ssh-agent agent in the OpenSSH encryption protection mechanism is related to key management errors. Exploiting this vulnerability can allow attackers to disclose the protected information...

Duplicate Advisory: Denial of service when decrypting attack controlled input in github.com/dvsekhvalnov/jose2go

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6294-6rgp-fr7r. This link is maintained to preserve external references. Original Description An attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted,...

Remote Encryption Attacks Surge: How One Vulnerable Device Can Spell Disaster

Ransomware groups are increasingly switching to remote encryption in their attacks, marking a new escalation in tactics adopted by financially motivated actors to ensure the success of their campaigns. "Companies can have thousands of computers connected to their network, and with remote...

Dell NetWorker Encryption Issue Vulnerability

Dell NetWorker is an application from Dell USA Inc. Provides forum discussion features for Dell Inc. A cryptographic issue vulnerability exists in Dell NetWorker Virtual Edition 19.8 and prior versions, which stems from the use of an unrecommended encryption algorithm by the SSH component, and ca...

PT-2023-31606 · Jose2Go +2 · Jose2Go +2

Name of the Vulnerable Software and Affected Versions: jose2go versions prior to 1.6.0 Description: The issue allows attackers to cause a denial of service, specifically CPU consumption, via a large p2c also known as PBES2 Count value in a PBES2 encrypted JWE blob. This can occur when an...

openSUSE 15 Security Update : putty (openSUSE-SU-2023:0411-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0411-1 advisory. - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity...

Prefix Truncation Attacks in SSH Specification (Terrapin Attack)

The remote SSH server is supporting an specific encryption algorithm or MAC. Parts of their SSH specification are vulnerable to a novel prefix truncation attack a.k.a. Terrapin attack. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, a...

GHSA-9WGG-M99Q-HHFC Expired tokens can be renewed without validating the account password

Impact In versions of the proxy from 2022-09-05 onwards since 8c874c2ff3d503ac20c7d32f46e08547fcb9e23f, expired OAuth 2.0 client credentials grant CCG flow authorisation tokens could be renewed automatically without checking their validity against the original account configuration i.e., the...

Moderate: Red Hat Security Advisory: opensc security update

An update for opensc is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Moderate: Red Hat Security Advisory: opensc security update

An update for opensc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

ALSA-2023:7879 Moderate: opensc security update

The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures. Security Fixes: OpenSC: Potential PIN bypass when card tracks it...

Siemens SIMATIC and SCALANCE Products Encryption Strength (CVE-2022-4304)

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages fo...

opensc security update

0.23.0-3 - Fix file caching with different offsets RHEL-4079 - Fix CVE-2023-40660: Potential PIN bypass - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init - Fix CVE-2023-4535: Out-of-bounds read in MyEID driver handling encryption using symmetric keys - Fix CVE-2023-5992: Side-channel...

ALSA-2023:7876 Moderate: opensc security update

The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures. Security Fixes: OpenSC: Potential PIN bypass when card tracks it...

Moderate: opensc security update

The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures. Security Fixes: OpenSC: Potential PIN bypass when card tracks it...

Authentication Bypass by Capture-replay

Overview Affected versions of this package are vulnerable to Authentication Bypass by Capture-replay during the establishment of the secure channel. An attacker can manipulate handshake sequence numbers to delete messages sent immediately after the channel is established. Note: 1 Sequence numbers...

QakBot Malware Resurfaces with New Tactics, Targeting the Hospitality Industry

A new wave of phishing messages distributing the QakBot malware has been observed, more than three months after a law enforcement effort saw its infrastructure dismantled by infiltrating its command-and-control C2 network. Microsoft, which made the discovery, described it as a low-volume campaign...