Configure Proper MACs Algorithms for the SSH Service

In cryptography, a message authentication code MAC is an authentication mechanism used by communication entities to check message integrity. If the configured algorithms are insecure, security risks increase because weak algorithms have been or are about to be cracked in the industry. The...

Configure the SSH Service Log Level Properly

SSH provides multiple log output levels, such as QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. A higher log level such as QUIET or FATAL prints less log information. This saves drive space but hinders administrators from auditing and tracing SSH events. Conversely, a lowe...

Disable the Root User from Logging in to the System Using SSH

The PermitRootLogin parameter in the SSH configuration file /etc/ssh/sshdconfig specifies whether the root user can log in to the system using SSH. The root user is not allowed to log in to the system using SSH. System administrators must use their own user to log in to the system using SSH and r...

Configuring the SSH Service Port Properly

A server typically has multiple NICs and IP addresses. You need to plan IP addresses to determine which ones are used for services or management. Not all IP addresses need to listen on SSH connections. You can specify only some IP addresses to perform SSH connections to reduce the attack surface...

Ensure That All Groups Exist in /etc/passwd

All user groups in /etc/passwd must exist in the /etc/group file. If the administrator manually modifies the two files, the user groups may be incorrectly set due to human errors. If a user group in /etc/passwd does not exist in /etc/group, risks of user group permission management may occur...

ACE: a Security Architecture for LLM-Integrated App Systems

LLM-integrated app systems extend the utility of Large Language Models LLMs with third-party apps that are invoked by a system LLM using interleaved planning and execution phases to answer user queries. These systems introduce new attack vectors where malicious apps can cause integrity violation ...

Privacy Challenges in Image Processing Applications

As image processing systems proliferate, privacy concerns intensify given the sensitive personal information contained in images. This paper examines privacy challenges in image processing and surveys emerging privacy-preserving techniques including differential privacy, secure multiparty...

Securing Immersive 360 Video Streams through Attribute-Based Selective Encryption

Delivering high-quality, secure 360� video content introduces unique challenges, primarily due to the high bitrates and interactive demands of immersive media. Traditional HTTPS-based methods, although widely used, face limitations in computational efficiency and scalability when securing these...

The vulnerability of the Platform V Pangolin DB database management system, related to data conflicts in BIO structures of OpenSSL, allows attackers to overwrite critical data, limit the ability to establish SSL connections, and cause data leaks from the process’s memory.

The vulnerability of the Platform V Pangolin DB database management system is related to a data conflict in the BIO structures of OpenSSL. Exploiting this vulnerability can allow an attacker to overwrite critical data, limit the ability to establish SSL connections, and cause data leaks from the...

Configure a Correct SSH Service Version

SSH1 contains known issues and is no longer maintained in a routine manner, which poses risks such as information leakage and command data tampering on the system. The OpenSSH component inherited by openEuler uses the SSH protocol for remote control or file transfer between servers. The SSH1.3,...

Correctly Configure the Default File Permission For rsyslog

Log files record system behaviors. The rsyslog log tool records logs in specified files. When the specified log file does not exist in the system, rsyslog creates a log file. The permission of the created log file can be configured in the rsyslog configuration file. The configuration of the defau...

PT-2025-20058 · Samsung +1 · Secure Folder +2

Name of the Vulnerable Software and Affected Versions: Secure Folder versions prior to 1.8.12.0 in Android 13 Secure Folder versions prior to 1.9.21.00 in Android 14 Description: The issue is related to improper authentication in Secure Folder, allowing physical attackers to reset the lock type...

PT-2025-20032 · Unknown · Boinc Server

Name of the Vulnerable Software and Affected Versions: BOINC Server versions through 1.4.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in BOINC Server. Recommendations: For...

Configure Proper SSH Key Exchange Algorithms

Key exchange is a process in which two parties exchange keys to allow the use of an encryption algorithm. A secure key exchange algorithm enables them to securely exchange keys, thereby using encryption algorithms to encrypt messages to be sent and decrypt received messages. Set the SSH key...

How to create a PVS master target device on Hyper-V for Windows 11

The objective here is to creating a PVS master target device VM on Hyper-V, which can be used for both installing Windows 11 and also booting via PVS. Windows 11 has installation requirements which need both Secure boot and TPM available. Hyper-V VM options which are relevant here: Secure boot...

The vulnerability of the microprogrammed control panel software for Honeywell MB-Secure and MB-Secure PRO devices arises from the lack of measures taken to neutralize special elements used in the operating system’s command sequence. This allows attackers to execute arbitrary commands with elevated privileges.

The vulnerability of the microprogrammed control panel software for Honeywell MB-Secure and MB-Secure PRO devices is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute...

Huawei EulerOS: Security Advisory for llvm (EulerOS-SA-2025-1428)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gather Source Package Manager Packages (nix)

Gather and store the source package data for rpm and dpkg package managers for future use during the scan. TRUSTED...

CVE-2025-47419

Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords. This issue affects Automate VX: from...

CVE-2025-47419 Non-Secure Access

Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords. This issue affects Automate VX: from...