pubnub Insufficient Entropy vulnerability

Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0;...

PT-2023-20533

Name of the Vulnerable Software and Affected Versions pubnub versions prior to 7.4.0 com.pubnub:pubnub all versions github.com/pubnub/go all versions github.com/pubnub/go/v7 versions prior to 7.2.0 pubnub/pubnub versions prior to 6.1.0 pubnub/c-core versions prior to 4.5.0 com.pubnub:pubnub-kotli...

New BLUFFS Bluetooth Attack Expose Devices to Adversary-in-the-Middle Attacks

New research has unearthed multiple novel attacks that break Bluetooth Classic's forward secrecy and future secrecy guarantees, resulting in adversary-in-the-middle AitM scenarios between two already connected peers. The issues, collectively named BLUFFS, impact Bluetooth Core Specification 4.2...

CVE-2023-31176

An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tokens and bypass authentication. See product Instruction Manual Appendix A dated 20230830 for more details...

Authentication flaw

An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tokens and bypass authentication. See product Instruction Manual Appendix A dated 20230830 for more details...

CVE-2023-31176

The CVE-2023-31176 entry concerns Schweitzer Engineering Laboratories SEL-451. The vulnerability arises from insufficient entropy in the device’s microprogram, enabling an unauthenticated remote attacker to brute-force session tokens and bypass authentication. Affected component: SEL-451 (protect...

Schweitzer Engineering Laboratories SEL-451 Security Feature Issue Vulnerability

Schweitzer Engineering Laboratories SEL-451 is a complete standalone system from Schweitzer Engineering Laboratories, Inc. A security vulnerability exists in the Schweitzer Engineering Laboratories SEL-451 that stems from the presence of an Entropy Insufficiency Vulnerability, which could allow a...

PT-2023-7442 · Schweitzer Engineering Laboratories · Sel-451

Name of the Vulnerable Software and Affected Versions: Schweitzer Engineering Laboratories SEL-451 affected versions not specified Description: The issue is related to insufficient entropy in the microprogram of the protective relay phase sequence of the Schweitzer Engineering Laboratories SEL-45...

Deepsecrets - Secrets Scanner That Understands Code

Yet another tool - why? Existing tools don't really "understand" code. Instead, they mostly parse texts. DeepSecrets expands classic regex-search approaches with semantic analysis, dangerous variable detection, and more efficient usage of entropy analysis. Code understanding supports 500+ languag...

CVE-2023-6142

Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames. With this an attacker can upload a malicious HTML file, then guess the filename of the uploaded file and send it to a potential victim...

CVE-2023-6142

Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames. With this an attacker can upload a malicious HTML file, then guess the filename of the uploaded file and send it to a potential victim...

Unrestricted file upload

Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames. With this an attacker can upload a malicious HTML file, then guess the filename of the uploaded file and send it to a potential victim...

CVE-2023-6142

Dev Blog v1.0 is affected by an XSS vulnerability triggered via an unrestricted file upload with poor filename entropy. An attacker can upload a malicious HTML file and then guess the filename to deliver it to a victim. Affected component: Dev Blog (Node.js/Express/MongoDB) v1.0; root cause: lack...

CVE-2023-6142 Dev Blog v1.0 - Stored XSS

Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames. With this an attacker can upload a malicious HTML file, then guess the filename of the uploaded file and send it to a potential victim...

PT-2023-32541 · Dev Blog · Dev Blog

Name of the Vulnerable Software and Affected Versions: Dev blog version 1.0 Description: The issue allows an attacker to exploit a cross-site scripting XSS vulnerability through an unrestricted file upload, combined with a bad entropy of filenames. This enables the attacker to upload a malicious...

Oracle Linux 9 : c-ares (ELSA-2023-6635)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6635 advisory. - Resolves: rhbz2209564 - CVE-2023-31124 c-ares: AutoTools does not set CARESRANDOMFILE during cross compilation rhel-9 - Resolves: rhbz2209556 -...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2023-3115)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

c-ares: Insufficient randomness in generation of DNS query IDs

A vulnerability was found in c-ares. This issue occurs when /dev/urandom or RtlGenRandom are unavailable, c-ares will use rand to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand, so it will generate predictable output...

c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation

A flaw was found in c-ares. This issue occurs when cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will not be set, as seen when cross-compiling aarch64 android. As a result, it will downgrade to rand, which could allow an attacker to utilize the lack of entropy by no...

RHEL 9 : c-ares (RHSA-2023:6635)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6635 advisory. The c-ares C library defines asynchronous DNS Domain Name System requests and provides name resolving API. The following packages have been...