CVE-2017-13102

The CVE-2017-13102 entry concerns the iOS app Asphalt Xtreme: Offroad Rally Racing (Gameloft), version 1.6.0 (2017-08-13). The root cause is the use of a hard-coded encryption key, enabling data encrypted with that key to be decrypted by anyone who has the key. This vulnerability exposes stored d...

CVE-2017-13104

CVE-2017-13104 affects UberEATS: Uber for Food Delivery (iOS) version 1.108.10001; vulnerability stems from a hard-coded encryption key used by the app, enabling data stored with that key to be decrypted by anyone who has the key. Public CVSS metrics in the record show total base score 7.5 (HIGH)...

PT-2018-5477

Name of the Vulnerable Software and Affected Versions: Gameloft Asphalt Xtreme: Offroad Rally Racing version 1.6.0 Description: The issue concerns the use of a hard-coded key for encryption in the iOS application. This means that data stored using this key can potentially be decrypted by anyone w...

PT-2018-5476

Name of the Vulnerable Software and Affected Versions: musical.ly version 6.1.6 Description: The issue concerns the use of a hard-coded key for encryption in the iOS application. This means that data stored using this key can be decrypted by anyone who can access the key. Recommendations: For...

PT-2018-5475

Name of the Vulnerable Software and Affected Versions: The Moron Test version 6.3.1 Description: The issue concerns the use of a hard-coded key for encryption in the iOS application. This means that data stored using this key can be decrypted by anyone who can access the key. Recommendations: For...

PT-2018-5479

Name of the Vulnerable Software and Affected Versions: UberEATS version 1.108.10001 Description: The issue concerns the use of a hard-coded key for encryption in the iOS application. This means that data stored using this key can be decrypted by anyone who can access the key. Recommendations: For...

PT-2018-5482

Name of the Vulnerable Software and Affected Versions: Live.me version 3.7.20 Description: The Android application uses a hard-coded key for encryption, which means that data stored using this key can be decrypted by anyone able to access this key. Recommendations: For version 3.7.20, consider...

PT-2018-5483

Name of the Vulnerable Software and Affected Versions: DFNDR Security Antivirus, Anti-hacking & Cleaner version 5.0.9 Description: The Android application uses a hard-coded key for encryption, which means that data stored using this key can be decrypted by anyone able to access this key...

PT-2018-5481

Name of the Vulnerable Software and Affected Versions: Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient version 5.0.3 Description: The Android application uses a hard-coded key for encryption, which means that data stored using this key can be decrypted by anyone able to access...

Dialogic PowerMedia XMS Hard-Coded Encryption Key Vulnerability

Dialogic PowerMedia XMS is a suite of software multimedia servers for real-time communications from Dialogic, Inc. that provide real-time multimedia communication solutions for IMS, MRF, enterprise and WebRTC applications. A security vulnerability in the /var/www/xms/application/config/config.php...

CVE-2018-11635

Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to bypass authentication...

WUZHI CMS SQL Injection Vulnerability (CNVD-2018-11099)

WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A SQL injection vulnerability exists in the api/uc.php file in WUZHI CMS version 4.1.0, which stems from the use of hard-coded values for 'UCKEY'. A remote attacke...

Trend Micro Email Encryption Gateway Authentication Vulnerability

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. A security vulnerability exists in the DBCrypto class in Trend Micro TMEEG versi...

TP-Link EAP Controller and Omada Controller Hardcoding Vulnerability

TP-Link EAP Controller and Omada Controller are both software from China P&L TP-LINK for remote control of wireless AP access point devices. A security vulnerability exists in the Web application backup file in TP-Link EAP Controller and Omada Controller versions 2.5.4Windows and 2.6.0Windows,...

TP-Link EAP Controller CSRF / Hard-Coded Key / XSS

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ TP-Link EAP Controller Multiple Vulnerabilities 1. Advisory Information Title: TP-Link EAP Controller Multiple Vulnerabilities Advisory ID: CORE-2018-0001 Advisory URL:...

CVE-2018-10167

The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows is encrypted with a hard-coded cryptographic key, so anyone who knows that key and the algorithm can decrypt it. A low-privilege user could decrypt and modify the backup file in...

CVE-2018-10167

The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows is encrypted with a hard-coded cryptographic key, so anyone who knows that key and the algorithm can decrypt it. A low-privilege user could decrypt and modify the backup file in...

PT-2018-9729

Name of the Vulnerable Software and Affected Versions: TP-Link EAP Controller and Omada Controller versions 2.5.4 Windows through 2.6.0 Windows Description: The issue concerns the encryption of the web application backup file, which uses a hard-coded cryptographic key. This allows anyone with...

CVE-2017-14014

Summary of CVE-2017-14014 : The Boston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI before it is transferred to removable media. This creates a vulnerability (CWE-321: Use of Hard-coded Cryptographic Key) with CVSS3 base score 4.6 (vector AV:P/AC:L/PR...

Perforce Plugin credentials can be obtained by users with Job/Extended Read permission

Jenkins prevents users with Extended Read permission from obtaining secrets such as credentials stored in job configurations. Perforce Plugin implements its own credential encryption using DES and an encryption key stored in its public source code. This is not considered a secret by Jenkins,...