CVE-2019-6693

CVE-2019-6693 Déchiffrer les secrets de configuration FortiGate Original advisory Vendor advisory Pour les VM/appliances FortiGate antérieures aux versions 6.2.0, 6.0.0 à 6.0.6, 5.6.10, les secrets de configuration sont stockés chiffrés avec une clé unique. Pour les versions supérieures, le...

CVE-2024-5764

CVE-2024-5764 Ce dépôt contient un script Python capable d'exploiter CVE-2024-5764 en déchiffrant des données chiffrées avec la clé de chiffrement statique. L'annonce de Sonatype est disponible ici. Utilisation root@kitploit: usage: cve-2024-5764.py -h -e ENCRYPTEDPAYLOAD -p PASSPHRASE Decrypt da...

CVE-2026-57262

The CVE-2026-57262 vulnerability affects LOGO! Soft Comfort (All versions

EUVD-2026-51103

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the...

CVE-2026-54367

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the...

EUVD-2026-39592

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic...

CVE-2026-9220 Setracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic key

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic...

CVE-2024-39342

Entrust Instant Financial Issuance formerly known as Cardwizard 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library i.e. DCG.Security.dll with a custom AES encryption process that relies on static hard-coded key values. These keys are not uniquely generated per installation of t...

EUVD-2018-8951

Malware in sbrugna...

EUVD-2019-15297

Malware in sbrugna...

EUVD-2019-17742

Malware in sbrugna...

EUVD-2022-34888

Malicious code in bioql PyPI...

EUVD-2023-37448

Malicious code in bioql PyPI...

EUVD-2022-28660

Malicious code in bioql PyPI...

CVE-2023-33283

Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them by using this key...

CVE-2022-23724

Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials...

CVE-2018-17177

An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called "black box" logs event logs and core dumps to a USB stick. These logs are RC4-encrypted with a 9-character password of ^JEd4W!I that is obfuscated by hiding ...

CVE-2024-12078 ECOVACS lawnmowers and vacuums static BLE GATT encryption key

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key...

CVE-2024-5764 Nexus Repository 3 - Static hard-coded encryption passphrase used by default

Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database SMTP or HTTP proxy credentials, user tokens, tokens, among others. The affected versions relied on ...

CVE-2024-20280

A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method that is used fo...