Inadequate Encryption Strength

Overview randompasswordgenerator is a generates a random password with various useful options. Affected versions of this package are vulnerable to Inadequate Encryption Strength due to the use of Kernelrand to generate passwords, which, as a result of its cyclic nature, can facilitate password...

CVE-2021-32010

Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle attacks. This issue affects: Secomea SiteManager All versions prior to 9.7. Secomea LinkManager versions prior to 9.7. Secomea GateManager versions prior to...

CVE-2021-32010 Clients may connect to a GateManager with TLS 1.0

Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle attacks. This issue affects: Secomea SiteManager All versions prior to 9.7. Secomea LinkManager versions prior to 9.7. Secomea GateManager versions prior to...

CVE-2022-1318 Hills ComNav Inadequate Encryption Strength

Hills ComNav version 3002-19 suffers from a weak communication channel. Traffic across the local network for the configuration pages can be viewed by a malicious actor. The size of certain communications packets are predictable. This would allow an attacker to learn the state of the system if the...

HPE OneView Authentication Bypass Vulnerability

HPE OneView is a software from Hewlett Packard Enterprise HPE that facilitates automated device management for IT departments. versions prior to HPE OneView 6.6 contain an authentication bypass vulnerability that stems from insufficient program authentication strength and can be exploited by an...

Bypassing Two-Factor Authentication

These techniques are not new, but theyre increasingly popular: …some forms of MFA are stronger than others, and recent events show that these weaker forms arent much of a hurdle for some hackers to clear. In the past few months, suspected script kiddies like the Lapsus$ data extortion gang and...

Siemens RUGGEDCOM Devices

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

Gitea Licensing Issue Vulnerability

Gitea is a lightweight Go-based git service developed by the Gitea community. Gitea is vulnerable to an authorization issue in versions prior to 1.5.0, which stems from the application's lack of authentication measures or insufficient authentication strength. An attacker could exploit the...

CVE-2022-24318

A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used. Affected Product: ClearSCADA All Versions, EcoStruxure Geo SCADA Expert 2019 All Versions, EcoStruxure Geo SCADA Expert...

CVE-2022-24318

CVE-2022-24318 affects ClearSCADA (All Versions) and EcoStruxure Geo SCADA Expert 2019/2020. The root cause is CWE-326: Inadequate Encryption Strength, causing non‑encrypted communication with the server when using outdated ViewX clients. The CVSS metrics updated show an attacker‑friendly network...

CVE-2022-24318

A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used. Affected Product: ClearSCADA All Versions, EcoStruxure Geo SCADA Expert 2019 All Versions, EcoStruxure Geo SCADA Expert...

Siemens SIPROTEC 4, SIPROTEC Compact, DIGSI 4, and EN100 Ethernet Module Inadequate Encryption Strength (CVE-2018-4839)

A vulnerability has been identified in DIGSI 4 All versions V4.92, EN100 Ethernet module DNP3 variant All versions V1.05.00, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.30, EN100 Ethernet module Modbus TCP variant All versions, EN100...

PT-2022-6474 · Libde265 +3 · Libde265 +3

Name of the Vulnerable Software and Affected Versions: libde265 versions 1.0.8 Description: The issue is related to incorrect access control in the derive boundaryStrength function of the deblock.cc component in the libde265 video codec implementation. This can cause a segmentation fault and...

GHSA-RFMP-JVR7-HX78 Inadequate Encryption Strength in Apache NiFi

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced...

Inadequate Encryption Strength in Apache NiFi

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced...

DayByDay CRM Information Disclosure Vulnerability (CNVD-2022-68550)

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. An information disclosure vulnerability exists in DayByDay CRM. The vulnerability stems from the product's update feature that does not...

Daybyday CRM 处理逻辑错误漏洞

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. An information disclosure vulnerability exists in DayByDay CRM. The vulnerability stems from the product's update feature that does not...

New Mobile Network Vulnerabilities Affect All Cellular Generations Since 2G

Researchers have disclosed security vulnerabilities in handover, a fundamental mechanism that undergirds modern cellular networks, which could be exploited by adversaries to launch denial-of-service DoS and man-in-the-middle MitM attacks using low-cost equipment. The "vulnerabilities in the...

Oracle Database Weak NNE Integrity Key Derivation

Advisory ID: SYSS-2021-062 Product: Database Manufacturer: Oracle Affected Versions: 12.1.0.2, 12.2.0.1, 19c Tested Versions: 18c Vulnerability Type: Inadequate Encryption Strength CWE-326 Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2021-03-17 Solution Date: 2021-08-07...

Oracle Database Weak NNE Integrity Key Derivation Vulnerability

NNE's integrity protection mechanism deliberately weakens the key used for computing per-packet message authentication codes MACs. Oracle Database versions 19c, 12.2.0.1, and 12.1.0.2 are affected. Product: Database Manufacturer: Oracle Affected Versions: 12.1.0.2, 12.2.0.1, 19c Tested Versions:...