Cisco Multiple Products Use of a Broken or Risky Cryptographic Algorithm (CVE-2020-26147)

The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and...

Amazon Linux 2 : thunderbird (ALAS-2024-2497)

The version of thunderbird installed on the remote host is prior to 115.8.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2497 advisory. The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message i...

Cisco Multiple Products Use of a Broken or Risky Cryptographic Algorithm (CVE-2020-24586)

The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and...

Cisco Multiple Products Use of a Broken or Risky Cryptographic Algorithm (CVE-2020-24588)

The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and...

Amazon Linux 2 : libpq (ALASPOSTGRESQL14-2024-010)

The version of libpq installed on the remote host is prior to 14.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-010 advisory. In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos...

[SECURITY] Fedora 38 Update: opensc-0.25.0-1.fc38

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the PKCS11 API so...

CVE-2021-47131

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix use-after-free after the TLS device goes down and up When a netdev with active TLS offload goes down, tlsdevicedown is called to stop the offload and tear down the TLS context. However, the socket stays alive, and it...

CVE-2024-2495

CVE-2024-2495 affects FriendlyWrt firmware (example version: 2022-11-16.51b3d35). The connected documents describe a plaintext cryptographic key vulnerability in the firmware, exposing the key material and enabling an attacker to compromise the confidentiality and integrity of encrypted data. The...

[SECURITY] Fedora 38 Update: baresip-3.10.1-1.fc38

A modular SIP user-agent with support for audio and video, and many IETF standards such as SIP, SDP, RTP/RTCP and STUN/TURN/ICE for both, IPv4 and IPv6. Additional modules provide support for audio codecs like Codec2, G.711, G.722, G.726, GSM, L16, MPA and Opus, audio drivers like ALSA, GStreamer...

Fedora 39 : opensc (2024-6460a03e29)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-6460a03e29 advisory. New upstream release with security fixes for CVE-2023-5992 and CVE-2024-1454 Tenable has extracted the preceding description block directly from the...

PT-2025-6256 · Fortinet · Fortimanager

Name of the Vulnerable Software and Affected Versions: FortiManager versions 6.4 through 7.6.1 FortiManager version 7.0 Description: The issue is related to the use of a hard-coded cryptographic key in the FortiManager interface, which can allow a remote attacker to disclose confidential...

Fedora 38 : opensc (2024-b92d44f141)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b92d44f141 advisory. New upstream release with security fixes for CVE-2023-5992 and CVE-2024-1454 Tenable has extracted the preceding description block directly from the...

CVE-2024-25649

In Delinea PAM Secret Server 11.4, it is possible for an attacker with Administrator access to the Secret Server machine to read the following data from a memory dump: the decrypted master key, database credentials when SQL Server Authentication is enabled, the encryption key of RabbitMQ queue...

CVE-2024-25649

In Delinea PAM Secret Server 11.4, it is possible for an attacker with Administrator access to the Secret Server machine to read the following data from a memory dump: the decrypted master key, database credentials when SQL Server Authentication is enabled, the encryption key of RabbitMQ queue...

CVE-2024-2413

Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the user's name and timestamp to generate an authentication code. With this authentication code, they can obtain administrator privileges and subsequently execute...

CVE-2024-2413

CVE-2024-2413 affects Intumit SmartRobot, which uses a fixed cryptographic key for authentication. This allows remote attackers to craft an authentication code by encrypting a string of the user’s name and a timestamp, enabling administrator privileges and potential arbitrary code execution on th...

Fedora 38 : thunderbird (2024-325c1d1fce)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-325c1d1fce advisory. Update to 115.8.1 https://www.mozilla.org/en-US/security/advisories/mfsa2024-11/ read that if you have mails with encrypted email subjects...

The vulnerability of the implementation package for the JWE, JWS, and JWT go-jose standards in the Go programming language lies in its improper handling of highly compressed input data. This allows attackers to trigger service failures.

The vulnerability of the implementation package for the JWE, JWS, and JWT go-jose standards in the Go programming language is related to incorrect processing of highly compressed input data. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

Malicious code in mastercard-postman-encryption-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 691dd44f85f523c698375261ea598d5fdee9c92da99d633a29b32bc5a2b44068 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1084 Malicious code in mastercard-postman-encryption-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 691dd44f85f523c698375261ea598d5fdee9c92da99d633a29b32bc5a2b44068 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...