CVE-2021-36750

ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users across USB drives sold under multiple brand names...

CVE-2021-36750

ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users across USB drives sold under multiple brand names...

ca.uhn.hapi.fhir.karaf:hapi-fhir (>=3.3.0, <=3.7.0), com.esri.geoevent.sdk:geoevent-sdk (>=10.6.0, <=10.9.0) +201 more potentially affected by unknown CVE via org.ops4j.pax.logging:pax-logging-log4j2 (>=1.8.2, <=1.11.9)

org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =1.8.2, =3.3.0, =10.6.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =0.2.0, =7.3.0, =7.3.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.7.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-XXFH-X98P-J8FR...

Vault API Endpoint Exposed Internal IP Address Without Authentication

Summary Vault and Vault Enterprise “Vault” would disclose the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. This vulnerability, CVE-2021-3024, was fixed in Vault 1.6.2 & 1.5.7. Background Vault’s API is the primary means by which a Vault nod...