BlackBerry QNX Software Development Platform Unauthorized Operation Vulnerability

The BlackBerry QNX Software Development Platform SDP is a suite of software development platforms from BlackBerry Canada dedicated to the development of software based on the QNX system. A security vulnerability exists in the default configuration of QNX SDP in BlackBerry QNX SDP version 6.6.0 an...

CVE-2017-9371

In BlackBerry QNX Software Development Platform SDP 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default configuration of the QNX SDP could allow an attacker being able to reduce the entropy of the PRNG, making other blended attacks more practical by gaining control...

CVE-2017-9371

In BlackBerry QNX Software Development Platform SDP 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default configuration of the QNX SDP could allow an attacker being able to reduce the entropy of the PRNG, making other blended attacks more practical by gaining control...

Default configuration

In BlackBerry QNX Software Development Platform SDP 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default configuration of the QNX SDP could allow an attacker being able to reduce the entropy of the PRNG, making other blended attacks more practical by gaining control...

CVE-2017-9371

BlackBerry QNX SDP affects versions 6.6.0 and 6.5.0 SP1 and earlier. Root cause: default configuration allows entropy reduction of the PRNG, increasing seed-generation control and enabling related integrity issues. Impact: partial integrity loss; no exploitation details provided. Remediation: no ...

CVE-2017-9371

In BlackBerry QNX Software Development Platform SDP 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default configuration of the QNX SDP could allow an attacker being able to reduce the entropy of the PRNG, making other blended attacks more practical by gaining control...

DUHK Attack Exposes Gaps in FIPS Certification

Despite the obligatory logo and clever name, this week’s assault on crypto, the so-called DUHK attack Don’t Use Hardcoded Keys, isn’t likely to be part of many threat models. Though the attack can be used to passively decrypt VPN and encrypted browser traffic, it relies on a host of implementatio...

DUHK Attack Lets Hackers Recover Encryption Key Used in VPNs & Web Sessions

DUHK — Don't Use Hard-coded Keys — is a new 'non-trivial' cryptographic implementation vulnerability that could allow attackers to recover encryption keys that secure VPN connections and web browsing sessions. DUHK is the third crypto-related vulnerability reported this month after KRACK Wi-Fi...

Insecure Psuedo-Random Number Generation (PRNG)

symfony/symfony uses insecure pseudo-random number generation PRNG. If an application is not using PHP 7, the opensslrandompseudobytes function fails to generate random numbers securely, allowing attackers to defeat the cryptographic protections easier...

EulerOS 2.0 SP1 : libgcrypt (EulerOS-SA-2016-1081)

According to the version of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A design flaw was found in the libgcrypt PRNG Pseudo-Random Number Generator. An attacker able to obtain the first 580 bytes of the PRNG output...

Cryptographic Protection Bypass

OpenSSL is vulnerable to cryptographic protection bypass. This is possible because it doesn't ensure that the PRNG is seeded before proceeding with a handshake. The flaw allows attackers to defeat the cryptographic protection mechanisms by sniffing the network then performing a brute-force attack...

OLX: yaman.olx.ph/wordpress is using a very vulnerable version of WordPress and contains directory listing

Hello , I want to report that your website is using a vulnerable version of WordPress which is 4.7 Released on 2016-12-06 . This Can be identified from the read me file located here , and that your website contains directory listing of the web-includes located hereز Bugs in this WordPress version...

Alvosec: Alvocrypt uses a cryptographically insecure PRNG.

Dear Alvosec bug bounty team, Summary --- A PRNG is an algorithm used to produce random-looking numbers with certain desirable statistical properties. In order for a PRNG to be cryptographically secure it must be resistant to prediction. The generatepass function in Alvocrypt currently uses...

WordPress 3.0-4.7 - Cryptographically Weak Pseudo-Random Number Generator (PRNG)

...

Tenable Passive Vulnerability Scanner 5.x < 5.2.0 Multiple Vulnerabilities (SWEET32)

The version of Tenable Passive Vulnerability Scanner PVS installed on the remote host is 5.x 5.2.0. It is, therefore, affected by multiple vulnerabilities : - Multiple denial of service vulnerabilities exist in Expat within file xmlparse.c due to a logical error in hash computations. An...

CVE-2016-9154

Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D All firmware versions V6.00.046 and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U All...

Gratipay: Gratipay uses the random module's cryptographically insecure PRNG.

Dear Gratipay bug bounty team, Summary --- Gratipay currently uses the random module's pseudo-random number generator which is not a cryptographically secure PRNG as stated in the docs: The pseudo-random generators of this module should not be used for security purposes. For security or...

RedHat Update for libgcrypt RHSA-2016:2674-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 6 / 7 : libgcrypt (CESA-2016:2674)

An update for libgcrypt is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

CentOS Update for libgcrypt CESA-2016:2674 centos6

Check the version of libgcrypt SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882589";...