EUVD-2025-203945

Amazon S3 Encryption Client has a Key Commitment Issue...

GHSA-3G75-Q268-R9R6 Amazon S3 Encryption Client has a Key Commitment Issue

Summary S3 Encryption Client for Go is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible Salamanders"...

Amazon S3 Encryption Client has a Key Commitment Issue

Summary S3 Encryption Client for Go is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible Salamanders"...

CVE-2025-67745 Myhoard logs backup encryption key in plain text

MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the whole backup info, including the encryption key. Version 1.3.0 fixes the issue. As a workaround, direct logs into /dev/null...

CVE-2025-67745 Myhoard logs backup encryption key in plain text

MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the whole backup info, including the encryption key. Version 1.3.0 fixes the issue. As a workaround, direct logs into /dev/null...

EUVD-2025-204404

MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the whole backup info, including the encryption key. Version 1.3.0 fixes the issue. As a workaround, direct logs into /dev/null...

CVE-2025-67745 Myhoard logs backup encryption key in plain text

MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the whole backup info, including the encryption key. Version 1.3.0 fixes the issue. As a workaround, direct logs into /dev/null...

CVE-2025-67745

CVE-2025-67745 affects the MyHoard daemon for MySQL backups. In versions prior to 1.3.0, logs may include the full backup information including the encryption key, enabling potential disclosure. Version 1.3.0 fixes the issue. A workaround is to direct logs to /dev/null. Affected software is MyHoa...

EUVD-2025-203944

Amazon S3 Encryption Client for Java has a Key Commitment Issue...

GHSA-X44P-GVRJ-PJ2R Amazon S3 Encryption Client for Java has a Key Commitment Issue

Summary S3 Encryption Client for Java is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible Salamander...

org.apache.hadoop:hadoop-aws (3.4.2) potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (3.1.1)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on software.amazon.encryption.s3:amazon-s3-encryption-client-java and may be impacted: - org.apache.hadoop:hadoop-aws 3.4.2...

net.snowflake:snowflake-jdbc-thin (4.0.0) potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (3.4.0)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on software.amazon.encryption.s3:amazon-s3-encryption-client-java and may be impacted: - net.snowflake:snowflake-jdbc-thin...

org.apache.nifi:nifi-aws-abstract-processors (>=2.7.0, <=2.7.2), org.apache.nifi:nifi-aws-kinesis-nar (>=2.7.0, <=2.7.2) +4 more potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (3.5.0)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on software.amazon.encryption.s3:amazon-s3-encryption-client-java and may be impacted: -...

Amazon S3 Encryption Client for Java has a Key Commitment Issue

Summary S3 Encryption Client for Java is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible Salamander...

EUVD-2025-203939

Amazon S3 Encryption Client for .NET has a Key Commitment Issue...

Amazon S3 Encryption Client for .NET has a Key Commitment Issue

Summary S3 Encryption Client for .NET S3EC is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible...

GHSA-4V42-65R3-3GJX Amazon S3 Encryption Client for .NET has a Key Commitment Issue

Summary S3 Encryption Client for .NET S3EC is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible...

CVE-2024-29370

A flaw was found in python-jose. This vulnerability allows an attacker to cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high compression ratio, leading to significant memory allocation and processing time during decompression...

CVE-2025-67168

RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords...

CVE-2025-62002: Improperly Implemented Security Check for Standard

BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single possibly large file without triggering detection if thresholds are configured to require multiple file changes. The number of files to trigger detection ca...