Tell Me Your Secrets Without Telling Me Your Secrets

The title of this article probably sounds like the caption to a meme. Instead, this is an actual problem GitGuardian's engineers had to solve in implementing the mechanisms for their new HasMySecretLeaked service. They wanted to help developers find out if their secrets passwords, API keys, priva...

CodeIgniter Shield Security Vulnerabilities

CodeIgniter Shield is the authentication and authorization module for CodeIgniter 4 from CodeIgniter, Inc. A security vulnerability exists in CodeIgniter Shield versions prior to 1.0.0-beta.8 that stems from the use of plaintext to store sensitive information in HMAC SHA256 authentication...

VulnCheck KEV: CVE-2017-7927

A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3,...

The vulnerability of Siemens SCALANCE industrial switches’ microprogramming software, related to the use of a weak password hash function, allows attackers to modify the device’s configuration.

The vulnerability of Siemens SCALANCE industrial switches’ microprogrammed software is related to the use of a weak password hash function. Exploiting this vulnerability could allow an attacker to remotely modify the device’s configuration...

Slackware Linux 15.0 kernel-generic Multiple Vulnerabilities (SSA:2023-325-01)

The version of kernel-generic installed on the remote host is prior to 5.15.139 / 5.15.139smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-325-01 advisory. New kernel packages are available for Slackware 15.0 to fix security issues. Tenable has extracted t...

Multiple vulnerabilities in EXPRESSCLUSTER X

Overview WebManager/Cluster WebUI of EXPRESSCLUSTER X provided by NEC Corporation contains multiple vulnerabilities listed below. Missing authorization CWE-862 - CVE-2023-39544 Files or directories accessible to external parties CWE-552 - CVE-2023-39545 Use of password hash instead of password fo...

The vulnerability of the implementation of the HMAC (Hash-based Message Authentication Code) algorithm in Windows operating systems allows attackers to circumvent security restrictions and enhance their privileges.

The vulnerability of the HMAC Hash-based Message Authentication Code algorithm implementation in Windows operating systems is related to deficiencies in access control during key generation. Exploiting this vulnerability can allow attackers to circumvent security restrictions and enhance their...

CVE-2023-48024

Liblisp through commit 4c65969 was discovered to contain a use-after-free vulnerability in void hashdestroyhashtablet h at hash.c...

CVE-2023-48024

Liblisp through commit 4c65969 was discovered to contain a use-after-free vulnerability in void hashdestroyhashtablet h at hash.c...

Hyperledger: CVE-2023-46132

A vulnerability was discovered in which the way transactions were hashed in Fabric blockchain blocks allowed an attacker to manipulate the transaction data while keeping the block hash unchanged. This could enable an adversary to fork the blockchain network state through malicious blocks that...

PT-2023-30671 · Liblisp · Liblisp

Name of the Vulnerable Software and Affected Versions: Liblisp through commit 4c65969 Description: A use-after-free issue was found in the hash destroy function, located in hash.c. Recommendations: For versions through commit 4c65969, consider applying a patch that fixes the hash destroy function...

UBUNTU-CVE-2023-48237

Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This...

The vulnerability in the implementation of the SHA-1 cryptographic algorithm in Google Chrome’s browser allows attackers to perform spoofing attacks.

The vulnerability of the SHA-1 cryptographic algorithm implementation in Google Chrome browsers is related to the use of a weak encryption mechanism. Exploiting this vulnerability allows a remote attacker to perform rainbow attacks...

GHSA-V9W2-543F-H69M Fabric vulnerable to crosslinking transaction attack

Short summary Combining two molecules to one another, called "cross-linking" results in a molecule with a chemical formula that is composed of all atoms of the original two molecules. In Fabric, one can take a block of transactions and cross-link the transactions in a way that alters the way the...

CVE-2023-36400

Windows HMAC Key Derivation Elevation of Privilege Vulnerability...

kernel: hash collisions in the IPv6 connection lookup table

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6...

kernel: hash collisions in the IPv6 connection lookup table

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6...

Description of the security update for SharePoint Server 2019: November 14, 2023 (KB5002526)

None None...

Hyperledger Fabric Security Vulnerabilities

Hyperledger Fabric is an enterprise licensed distributed ledger framework. It is used to develop solutions and applications. Hyperledger Fabri has a security vulnerability that stems from a flaw in the way hash processing is performed, which allows an attacker to craft a cross-linking block that...

ALSA-2023:7077 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: tun: avoid double free in tunfreenetdev CVE-2022-4744 kernel: net/sched: multiple vulnerabilities CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208...