553 matches found
CVE-2025-15467
CVE-2025-15467: OpenSSL CMS AuthEnvelopedData Stack Buffer Overflow Overview CVE-2025-15467 is a critical stack buffer overflow vulnerability in OpenSSL's CMS Cryptographic Message Syntax parsing code. The vulnerability exists in the evpciphergetasn1aeadparams function when processing AES-GCM...
CVE-2026-109839
IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm...
CVE-2026-109839 IBM Db2 Genius Hub Missing Cryptographic Step
IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm...
CVE-2026-109839
IBM Db2 Genius Hub 1.0 is vulnerable to a security restriction bypass because of a missing initialization vector in its cryptographic algorithm (CWE-325). This flaw could be exploited by a remote authenticated attacker to impact the integrity of the system. To remediate this vulnerability, users ...
EUVD-2026-103023
IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm...
PT-2026-116000
IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm...
CVE-2026-109839: Missing Cryptographic Step
IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm...
Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub (Db2IC)
Summary Dependency updates and code fixes were done to fix multiple vulnerabilties found in Db2 intelligence center. Vulnerability Details CVEID:CVE-2026-109838 DESCRIPTION: IBM Db2 Genius Hub could allow a local attacker to obtain sensitive information due to improper verification of cryptograph...
CLEANSTART-2026-DN56273 Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializ...
Security vulnerability affects the apache-nifi-registry package. Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector...
CLEANSTART-2026-OS01121 Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializ...
Security vulnerability affects the rundeck package. Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector...
Astra Linux – Vulnerability in LibreOffice
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted using a single master key provided by the user. There was a flaw in LibreOffice where the required initialization vector for encryption was always the same,...
PT-2026-98275
Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who extracts this cryptographic material...
CVE-2026-54239 FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt and WPE\FaustWP\Auth\decrypt in...
Use Of A Broken Or Risky Cryptographic Algorithm
Spring Security is vulnerable to Use of a Broken or Risky Cryptographic Algorithm. The vulnerability is due to AesBytesEncryptor using AES/CBC with a null all-zero initialization vector, which allows an attacker to exploit predictable encryption and potentially infer relationships between encrypt...
CVE-2026-47842
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Sprin...
EUVD-2026-66677
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Sprin...
kernel: crypto: ccp - copy IV using skcipher ivsize
A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...
kernel: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
A use-after-free vulnerability was found in the Linux kernel's seqiv Sequence IV crypto module. After calling cryptoaeadencrypt, the underlying request may be freed by asynchronous completion handlers. The code then incorrectly dereferences req-iv to compare against info, accessing potentially...
CVE-2026-71225
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...
UBUNTU-CVE-2026-71225
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...