OSV-2023-728 Use-of-uninitialized-value in aesEncryptBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61670 Crash type: Use-of-uninitialized-value Crash state: aesEncryptBlock EncryptStream::lookChar BaseCryptStream::getChar...

QNAP Systems QTS 和 QuTS hero 加密问题漏洞

QNAP Systems QTS and QNAP Systems QuTS hero are both products of China-based QNAP Systems.QNAP Systems QTS is an operating system used by entry to mid-level QNAP NAS.QNAP Systems QuTS hero is an operating system. A security vulnerability exists in QNAP QTS and QuTS hero that stems from an...

PT-2023-4610 · Qnap · Qts +1

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.0.1.2425 build 20230609 QTS versions prior to 5.1.0.2444 build 20230629 QTS versions prior to 4.5.4.2467 build 20230718 QuTS hero h5.1.0 versions prior to 2424 build 20230609 QuTS hero h4.5.4 versions prior to 2476 bui...

PT-2023-29148 · Sick · Sick Lms5Xx

Name of the Vulnerable Software and Affected Versions: SICK LMS5xx affected versions not specified Description: A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transport Layer Security TLS in the SICK LMS5xx. This lack of encryption...

Meta Set to Enable Default End-to-End Encryption on Messenger by Year End

Meta has once again reaffirmed its plans to roll out support for end-to-end encryption E2EE by default for one-to-one friends and family chats on Messenger by the end of the year. As part of that effort, the social media giant said it's upgrading "millions more people's chats" effective August 22...

Amazon Linux 2 : qemu (ALAS-2023-2207)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2207 advisory. A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtiocryptohandlesymreq. The...

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may...

TP-LINK Smart bulb Tapo 安全漏洞

TP-LINK Smart bulb Tapo is a smart bulb from China P&L TP-LINK. An information disclosure vulnerability exists in the TP-LINK Smart bulb Tapo series L530 and Tapo Application, which can be exploited by an attacker to obtain sensitive information via the IV component of the AES128-CBC feature...

Medium: qemu

Issue Overview: A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtiocryptohandlesymreq. There is no check for the value of srclen and dstlen in virtiocryptosymophelper, potentially leading to a heap buffer overflow when the two values...

Google Chrome's New Feature Alerts Users About Auto-Removal of Malicious Extensions

Google has announced plans to add a new feature in the upcoming version of its Chrome web browser to proactively alert users when an extension they have installed has been removed from the Chrome Web Store. The feature, set for release alongside Chrome 117, allows users to be notified when an...

Monti Ransomware’s New Linux Variant Enhanced Encryption

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Monti ransomware, resembling Conti, resurfaces after a break, targeting legal and government sectors. A new Linux variant diverges significantly, using distinct tactics for encryption and virtual machine...

The vulnerability of the `var/lib/maxscale/maxscale.cnf.d` component, which is related to the MariaDB MaxScale proxy server, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the var/lib/maxscale/maxscale.cnf.d component of the MariaDB MaxScale proxy server is related to the lack of data encryption measures. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

Unveiling The TunnelCrack VPN Vulnerabilities

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The Tunnelcrack vulnerabilities are a set of four vulnerabilities that affect most VPN products. The vulnerabilities affect the way that VPNs handle certain ciphers, which are algorithms used to...

CVE-2023-40251

Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Man in the Middle Attack.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Genian NAC V5.0: from V5.0.0 through V5.0.42...

CVE-2023-40251

Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Man in the Middle Attack.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Genian NAC V5.0: from V5.0.0 through V5.0.42...

CVE-2023-40251

CVE-2023-40251 affects Genian NAC and related Genian products, with a root cause described as Missing Encryption of Sensitive Data. Affected: Genian NAC V4.0 (V4.0.0–V4.0.155), Genian NAC V5.0 (V5.0.0–V5.0.42, Revision 117460), Genian NAC Suite V5.0 (V5.0.0–V5.0.54), and Genian ZTNA (V6.0.0–V6.0....

CVE-2023-40251

Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Man in the Middle Attack.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Genian NAC V5.0: from V5.0.0 through V5.0.42...

[SECURITY] Fedora 38 Update: opensc-0.23.0-5.fc38

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the PKCS11 API so...

Genians Genian NAC 安全漏洞

Genians Genian NAC is a network security and access control software from Genians Korea. It helps organizations identify IP-enabled devices, manage vulnerabilities and check device configurations to protect network access environments. A security vulnerability exists in Genians Genian NAC that...

CVE-2023-4384

A vulnerability has been found in MaximaTech Portal Executivo 21.9.1.140 and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to missing encryption of sensitive data. The attack can be initiated remotely. The complexity of ...