Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...

GHSA-W8CC-3H7Q-JHC3 Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...

Password policy guidance

Why do we need strong passwords? Passwords are stored by using a one-way hashing algorithm to generate a representation of the original password on a securely designed system. Authentication mechanisms then compare the calculated hash of an entered password with the stored hash value to determine...

CVE-2020-28924

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limi...

PT-2022-3221 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.9 Description: The issue is related to insufficient entropy in the Linux kernel, allowing a remote attacker to identify clients by determining the original source ports used by the TCP server. This is due t...

GHSA-CHG9-3C3P-CH23 Lemur uses static IV per key

Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode...

Lemur uses static IV per key

Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode...

Google Chrome 78.0.3904.70 - Remote Code Execution Exploit

Exploit Title: Google Chrome 78.0.3904.70 - Remote Code Execution Exploit Author: deadlock Forrest Orr Type: RCE Platform: Windows Website: https://forrest-orr.net Twitter: https://twitter.com/ForrestOrr Vendor Homepage: https://www.google.com/chrome/ Software Link:...

Google Chrome 78.0.3904.70 Remote Code Execution

Exploit Title: Google Chrome 78.0.3904.70 - Remote Code Execution Date: 2022-05-03 Exploit Author: deadlock Forrest Orr Type: RCE Platform: Windows Website: https://forrest-orr.net Twitter: https://twitter.com/ForrestOrr Vendor Homepage: https://www.google.com/chrome/ Software Link:...

Google Chrome 78.0.3904.70 - Remote Code Execution

Exploit Title: Google Chrome 78.0.3904.70 - Remote Code Execution Date: 2022-05-03 Exploit Author: deadlock Forrest Orr Type: RCE Platform: Windows Website: https://forrest-orr.net Twitter: https://twitter.com/ForrestOrr Vendor Homepage: https://www.google.com/chrome/ Software Link:...

PT-2022-30224

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.112 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.9 and fixe...

PT-2022-29920

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.35 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-30431

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.190 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-29236

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.4 Description The issue concerns the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. Recommendations For versions prior to v5.17.4,...

PT-2022-30660

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.276 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-30567

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.239 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.9 and fixe...

PT-2022-30736

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.311 Description The issue is related to the use of /dev/urandom in gcc-plugins: latent entropy. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

CoreCollection: Starting index is pseudo-randomly generated, allowing for gameable NFT launches

Lines of code Vulnerability details Details & Impact In Paradigm’s article “A Guide to Designing Effective NFT Launches”, one of the desirable properties of an NFT launch is unexploitable fairness: Launches must have true randomness to ensure that predatory users cannot snipe the rarest items at...

The vulnerability of the Singularity container platform, related to insufficient entropy, allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Singularity container platform is related to insufficient entropy. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Dridex Malware Deploying Entropy Ransomware on Hacked Computers

Similarities have been unearthed between the Dridex general-purpose malware and a little-known ransomware strain called Entropy, suggesting that the operators are continuing to rebrand their extortion operations under a different name. "The similarities are in the software packer used to conceal...