CVE-2023-49292 Possible private key restoration in go package github.com/ecies/go

ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate, Decapsulate and ECDH could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade...

CVE-2023-26942

The provided CVEs describe weak encryption in RFID tag implementations used by Yale hardware: CVE-2023-26942 affects Yale IA-210 Alarm v1.0, CVE-2023-26941 affects Yale Conexis L1 v1.1.0, and CVE-2023-26943 affects Yale Keyless Lock v1.0. In each case, attackers with physical proximity can clone ...

CVE-2023-26943

CVE-2023-26943 describes weak encryption in RFID tags across Yale Lock family products (Keyless Lock v1.0; Conexis L1 v1.1.0; IA-210 Alarm v1.0), enabling tag cloning with physical proximity. Root cause: weak encryption in RFID tags. Red Hat advisories corroborate the same CVE across the Yale dev...

Yale IA-210 Alarm Security Vulnerability

The Yale IA-210 Alarm is a residential alarm from Yale. The Yale IA-210 Alarm v1.0 version suffers from a security vulnerability that stems from a weak encryption mechanism in the RFID tag, which allows an attacker to create a cloned tag by physically approaching the original tag...

Yale Conexis L1 Security Vulnerability

The Yale Conexis L1 is a smart door lock from Yale. A security vulnerability exists in the Yale Conexis L1 v1.0.0, which stems from a weak encryption mechanism in the RFID tag that allows an attacker to create a clone of the original tag by physically approaching it...

CVE-2023-26941

CVE-2023-26941 involves weak encryption in RFID tags used by Yale Conexis L1 v1.1.0, enabling a cloned tag via close proximity to the original. Red Hat records corroborate the same description. No explicit exploit details or remediation are provided in the supplied documents.

Yale Keyless Lock Security Vulnerability

Yale Keyless Lock is a keyless connected smart lock from Yale. A security vulnerability exists in Yale Keyless Lock v1.0, which stems from a weak encryption mechanism in the RFID tags, leading to an attacker being able to create a clone of the original tag by getting physically close to it...

PT-2023-20863 · Yale · Yale Ia-210 Alarm

Name of the Vulnerable Software and Affected Versions: Yale IA-210 Alarm version 1.0 Description: The issue is related to weak encryption mechanisms in RFID Tags, allowing attackers to create a cloned tag via physical proximity to the original. Recommendations: For Yale IA-210 Alarm version 1.0,...

CVE-2023-26941

Weak encryption mechanisms in RFID Tags in Yale Conexis L1 v1.1.0 allows attackers to create a cloned tag via physical proximity to the original...

CVE-2023-26943

Weak encryption mechanisms in RFID Tags in Yale Keyless Lock v1.0 allows attackers to create a cloned tag via physical proximity to the original...

CVE-2023-26942

Weak encryption mechanisms in RFID Tags in Yale IA-210 Alarm v1.0 allows attackers to create a cloned tag via physical proximity to the original...

PT-2023-20864 · Yale · Yale Keyless Lock

Name of the Vulnerable Software and Affected Versions: Yale Keyless Lock version v1.0 Description: The issue is related to weak encryption mechanisms in RFID Tags, which allows attackers to create a cloned tag via physical proximity to the original. Recommendations: For Yale Keyless Lock version...

PT-2023-20862 · Yale · Yale Conexis L1

Name of the Vulnerable Software and Affected Versions: Yale Conexis L1 version 1.1.0 Description: The issue is related to weak encryption mechanisms in RFID Tags, allowing attackers to create a cloned tag via physical proximity to the original. Recommendations: For Yale Conexis L1 version 1.1.0,...

Node.js: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding)

A timing side-channel vulnerability in the crypto library's privateDecrypt API allowed attackers to remotely exploit and decrypt or forge signatures when processing encrypted messages...

CVE-2023-46385

LOYTEC electronics GmbH LINX Configurator all versions is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to weakened security in Python Cryptographic Authority [CVE-2023-38325]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to weakened security in Python Cryptographic Authority, caused by an encoding mismatch regarding critical options with OpenSSH CVE-2023-38325. Python Cryptographic Authority is used for cryptography in our our...

Code injection

xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree the one that contain...

CVE-2023-49087 Validation of SignedInfo

xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree the one that contain...

CVE-2023-49087

The CVE-2023-49087 issue affects the xml-security library used by SimpleSAMLphp. The root cause is insufficient validation while computing or comparing signatures: if an attacker can manipulate the canonicalized DigestValue, the cryptographic signature on the SignedInfo tree could be forged. The ...

[SECURITY] Fedora 38 Update: openvpn-2.6.8-1.fc38

OpenVPN is a robust and highly flexible tunneling application that uses all of the encryption, authentication, and certification features of the OpenSSL library to securely tunnel IP networks over a single UDP or TCP port. It can use the Marcus Franz Xaver Johannes Oberhumers LZO library for...