Authentication flaw

A cryptographically weak pseudo-random number generator PRNG is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to...

CVE-2021-3047 PAN-OS: Weak Cryptography Used in Web Interface Authentication

A cryptographically weak pseudo-random number generator PRNG is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to...

CVE-2021-38586: Undefined Security Weakness

In cPanel before 98.0.1, /scripts/cpanconfig performs unsafe operations on files SEC-589...

CVE-2021-38531: Undefined Security Weakness

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.42, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6260 before 1.1.0.78, R6700v2 before 1.2.0.76, R6800 before 1.2.0.76, R6900v2...

Schneider-electric Modicon Inadequate Encryption Strength

A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 all references, all versions that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. File data...

SAP Business One 代码问题漏洞

SAP Business One is a suite of enterprise management software from SAP, a German company. SAP Business One has a code issue vulnerability that stems from insufficient validation when uploading files, which could be exploited to upload any file...

Qnap Systems VioGate 信任管理问题漏洞

QNAP Systems VioGate is a digital, networked and modular surveillance device from QNAP Systems. In addition to providing real-time monitoring, video recording, photo taking and video file playback, it can also be connected to a storage device through the network to store video files, and its...

CVE-2020-36469: Undefined Security Weakness

An issue was discovered in the appendix crate through 2020-11-15 for Rust. For the generic K and V type parameters, Send and Sync are implemented unconditionally...

CVE-2020-36467: Undefined Security Weakness

An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr::get returns more than one mutable reference to the same object...

CVE-2020-36470: Undefined Security Weakness

An issue was discovered in the disrustor crate through 2020-12-17 for Rust. RingBuffer doe not properly limit the number of mutable references...

CVE-2020-36466: Undefined Security Weakness

An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr implements Send and Sync for all types...

CVE-2020-36472: Undefined Security Weakness

An issue was discovered in the max7301 crate before 0.2.0 for Rust. The ImmediateIO and TransactionalIO types implement Sync for all Expander types that they contain...

CVE-2020-36471: Undefined Security Weakness

An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function for yielding values has Send bounds...

CVE-2020-36433: Undefined Security Weakness

An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement...

CVE-2021-38148: Undefined Security Weakness

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...

Metinfo CMS Privilege Escalation

The vulnerability of the /app/system/column/admin/index.class.php implementation in the Metinfo CMS system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

CVE-2021-29973: Undefined Security Weakness

Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user interaction with the page before a user's password would be entered by the browser's autofill functionality This bug only affects Firefox for Android. Other...

CVE-2021-29974: Undefined Security Weakness

When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security which implies that the error should not be override-able. This issue did not...

CVE-2021-3678

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG...

CVE-2021-3678

CVE-2021-3678 affects the showdoc project (star7th/showdoc) with a cryptographically weak PRNG. Connected sources (GHSA, Red Hat, OSV, CVE lists) consistently describe usage of insecure randomness (e.g., MD5-based/low-entropy paths, time/rand reliance) as the root cause. Impact details in the ref...