CVE-2023-40354

An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08....

CVE-2023-40354

Affected software: MariaDB MaxScale. Vulnerability details: When a user runs “maxctrl create service” and enters an encrypted password, the password is stored in cleartext in the generated /var/lib/maxscale/maxscale.cnf.d/.cnf file. Root cause/impact: This leaks credentials and can result in unau...

Insufficient Entropy

Overview Affected versions of this package are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bit...

Insufficient Entropy

Overview Affected versions of this package are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bit...

Insufficient Entropy

Overview Affected versions of this package are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bit...

Insufficient Entropy

Overview Affected versions of this package are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bit...

Insufficient Entropy

Overview Affected versions of this package are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bit...

Insufficient Entropy

Overview pubnub is a Publish & Subscribe Real-time Messaging with PubNub Affected versions of this package are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure whe...

Enhancing TLS Security: Google Adds Quantum-Resistant Encryption in Chrome 116

Google has announced plans to add support for quantum-resistant encryption algorithms in its Chrome browser, starting with version 116. "Chrome will begin supporting X25519Kyber768 for establishing symmetric secrets in TLS, starting in Chrome 116, and available behind a flag in Chrome 115," Devon...

The vulnerability of the Omnibox address bar in Google Chrome allows a hacker to execute a type of attack known as “man-in-the-middle” attack.

The vulnerability of the Omnibox address bar in Google Chrome relates to the lack of encryption measures for protected data. Exploiting this vulnerability could allow a remote attacker to execute a “man-in-the-middle” attack...

IBM Sterling Connect:Direct Encryption Issue Vulnerability

IBM Sterling Connect:Direct is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. IBM Sterling Connect:Direct suffers from an encryption issue vulnerability that stems from the use of weak encryption algorithms, which could be exploited by an attacker to...

CVE-2023-22956

CVE-2023-22956 – AudioCodes VoIP desk phones are affected up to firmware 3.4.4.1000. The root cause is the use of a hard-coded cryptographic key, enabling an attacker to decrypt encrypted configuration files and retrieve sensitive information. Evidence from multiple sources confirms the issue and...

Information Disclosure

IntelR Processors are vulnerable to Information Disclosure. This vulnerability occurs when an attacker uses a specially crafted instruction to access stale data from previously used vector registers on the same physical core. This could allow the attacker to infer sensitive information, such as...

Encryption Flaws in Popular Chinese Language App Put Users' Typed Data at Risk

A widely used Chinese language input app for Windows and Android has been found vulnerable to serious security flaws that could allow a malicious interloper to decipher the text typed by users. The findings from the University of Toronto's Citizen Lab, which carried out an analysis of the...

[SECURITY] Fedora 38 Update: krb5-1.21-3.fc38

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form...

HCL Technologies HCL Nomad Security Vulnerability

HCL Technologies HCL Nomad is an application for using and managing the Domino application development platform in mobile devices from HCL Technologies, USA. A security vulnerability exists in HCL Technologies HCL Nomad prior to version 1.0.7, which stems from a vulnerability that allows an attac...

New Android 14 Security Feature: IT Admins Can Now Disable 2G Networks

Google has introduced a new security feature in Android 14 that allows IT administrators to disable support for 2G cellular networks in their managed device fleet. The search giant said it's introducing a second user setting to turn off support, at the model level, for null-ciphered cellular...

Cloudflare Tunnel increasingly abused by cybercriminals

Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address. Cybercriminals are increasingly using this service to keep their activities from being detected. Cloudflare Tunnel, also known by its executable name, Cloudflared,...

Libbitcoin Explorer Security Feature Issue Vulnerability

Libbitcoin Explorer is a bitcoin command line tool open-sourced by Libbitcoin. Libbitcoin Explorer versions 3.0.0 through 3.6.0 suffer from a security vulnerability that stems from a security issue with the currency's encryption technology leading to the theft of funds...

PHOENIX CONTACTs WP 6xxx series web panels Trust Management Issues Vulnerability

PHOENIX CONTACTs WP 6xxx series web panels is a series of web panels from PHOENIX CONTACTs, Germany. A trust management issue vulnerability exists in PHOENIX CONTACTs WP 6xxx series web panels prior to version 4.0.10, where a remote attacker with administrator privileges is able to read a...