8896 matches found
CVE-2022-2582 Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it...
CVE-2022-2582
The CVE-2022-2582 issue concerns the AWS S3 Crypto SDK (Go) sending an unencrypted hash of the plaintext as a metadata field alongside ciphertext. This could enable brute‑force of the plaintext if readable. AWS has since blocks this field in newer SDKs; older versions still send it. Mitigation: u...
CVE-2022-2582
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it...
SUSE-SU-2022:4620-1 Security update for freeradius-server
This update for freeradius-server fixes the following issues: - CVE-2022-41859: Fixes an information leakage in EAP-PWD bsc1206204. - CVE-2022-41860: Fixes a crash on unknown option in EAP-SIM bsc1206205. - CVE-2022-41861: Fixes a crash on invalid abinary data bsc1206206. - move logrotate options...
AWS SDK for Android 加密问题漏洞
AWS SDK for Android is an AWS SDK for Android open source by AWS Amplify. A security vulnerability exists in AWS SDK for Android that stems from sending an unencrypted hash of plaintext along with ciphertext as a metadata field. If the hash is readable by an attacker, the hash can be used to brut...
HCL Technologies BigFix Server Automation 安全漏洞
HCL Technologies BigFix Server Automation is an endpoint management system from HCL Technologies, USA. A security vulnerability exists in HCL Technologies BigFix Server Automation that stems from its Notification Service that allows an attacker to gain access to sensitive data of SMTP BigFix...
The vulnerability of the AMQP protocol implementation of the message broker RabbitMQ in Dell EMC NetWorker’s backup and disaster recovery systems allows a perpetrator to escalate their privileges.
The vulnerability of the Advanced Message Queuing Protocol AMQP implementation of the message broker RabbitMQ in Dell EMC NetWorker’s backup and disaster recovery systems lies in the transmission of critical information in plaintext. Exploiting this vulnerability could allow an attacker to enhanc...
IBM Security Verify Governance Identity Manager Information Disclosure Vulnerability
IBM Security Verify Governance Identity Manager is an IBM network appliance-based integration that focuses on business-centric rules, activities, and processes.IBM Security Verify Governance Identity Manager version 10.0.1 is vulnerable to An information disclosure vulnerability exists in IBM...
CVE-2022-22457
IBM Security Verify Governance, Identity Manager 10.0.1 stores sensitive information including user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 225007...
CVE-2022-22457 IBM Security Verify Governance, Identity Manager information disclosure
IBM Security Verify Governance, Identity Manager 10.0.1 stores sensitive information including user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 225007...
DEBIAN-CVE-2020-15685
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird 78.7...
Design/Logic Flaw
If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. I...
Critical Security Flaw Reported in Passwordstate Enterprise Password Manager
Multiple high-severity vulnerabilities have been disclosed in Passwordstate password management solution that could be exploited by an unauthenticated remote adversary to obtain a user's plaintext passwords. "Successful exploitation allows an unauthenticated attacker to exfiltrate passwords from ...
IBM Security Verify Governance 安全漏洞
IBM Security Verify Governance Identity Manager is an IBM network appliance-based integration that focuses on business-centric rules, activities, and processes.IBM Security Verify Governance Identity Manager version 10.0.1 is vulnerable to An information disclosure vulnerability exists in IBM...
CVE-2020-15685
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird 78.7...
CVE-2020-15685
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird 78.7...
IBM Security Verify Governance 安全漏洞
IBM Security Verify Governance Identity Manager is an IBM network appliance-based integration that focuses on business-centric rules, activities, and processes.IBM Security Verify Governance Identity Manager version 10.0.1 is vulnerable to An information disclosure vulnerability exists in IBM...
CVE-2020-15685
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird 78.7...