Common Weakness Enumeration

CWE-326

Allowed-with-Review

Inadequate Encryption Strength

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

654 vulnerabilities reference this CWE, most recent first.

GHSA-7XPV-834V-X9RJ

Vulnerability from github – Published: 2025-05-28 18:33 – Updated: 2025-05-28 18:33
VLAI
Details

IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-38341"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326",
      "CWE-328"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-28T16:15:32Z",
    "severity": "MODERATE"
  },
  "details": "IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.",
  "id": "GHSA-7xpv-834v-x9rj",
  "modified": "2025-05-28T18:33:27Z",
  "published": "2025-05-28T18:33:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38341"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7234888"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-837H-J995-V8PG

Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-07-31 00:00
VLAI
Details

A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encryption algorithm for storage of sensitive data, which may allow an attacker to more easily obtain credentials used for access.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-27457"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326",
      "CWE-327"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-20T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encryption algorithm for storage of sensitive data, which may allow an attacker to more easily obtain credentials used for access.",
  "id": "GHSA-837h-j995-v8pg",
  "modified": "2022-07-31T00:00:58Z",
  "published": "2022-05-24T19:02:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27457"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-84GM-V5WH-659W

Vulnerability from github – Published: 2022-05-13 01:05 – Updated: 2025-04-12 12:34
VLAI
Details

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2014-0224"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-06-05T21:55:00Z",
    "severity": "HIGH"
  },
  "details": "OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the \"CCS Injection\" vulnerability.",
  "id": "GHSA-84gm-v5wh-659w",
  "modified": "2025-04-12T12:34:39Z",
  "published": "2022-05-13T01:05:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0224"
    },
    {
      "type": "WEB",
      "url": "https://www.novell.com/support/kb/doc.php?id=7015271"
    },
    {
      "type": "WEB",
      "url": "https://www.intersectalliance.com/wp-content/uploads/release_notes/ReleaseNotes_for_Snare_for_Windows.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.intersectalliance.com/wp-content/uploads/release_notes/ReleaseNotes_for_SNARE_for_MSSQL.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.imperialviolet.org/2014/06/05/earlyccs.html"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/docview.wss?uid=ssg1S1004671"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/docview.wss?uid=ssg1S1004670"
    },
    {
      "type": "WEB",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/941-security-advisory-0005"
    },
    {
      "type": "WEB",
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10075"
    },
    {
      "type": "WEB",
      "url": "https://kb.bluecoat.com/index?page=content\u0026id=SA80"
    },
    {
      "type": "WEB",
      "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946"
    },
    {
      "type": "WEB",
      "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=bc8923b1ec9c467755cd86f7848c50ee8812e441"
    },
    {
      "type": "WEB",
      "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=bc8923b1ec9c467755cd86f7848c50ee8812e441"
    },
    {
      "type": "WEB",
      "url": "https://filezilla-project.org/versions.php?type=server"
    },
    {
      "type": "WEB",
      "url": "https://discussions.nessus.org/thread/7517"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103586"
    },
    {
      "type": "WEB",
      "url": "https://blogs.oracle.com/sunsecurity/entry/cve_2014_0224_cryptographic_issues1"
    },
    {
      "type": "WEB",
      "url": "https://blogs.oracle.com/sunsecurity/entry/cve_2014_0224_cryptographic_issues"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/site/blogs/766093/posts/908133"
    },
    {
      "type": "WEB",
      "url": "http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc"
    },
    {
      "type": "WEB",
      "url": "http://ccsinjection.lepidum.co.jp"
    },
    {
      "type": "WEB",
      "url": "http://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-1-7.html"
    },
    {
      "type": "WEB",
      "url": "http://esupport.trendmicro.com/solution/en-US/1103813.aspx"
    },
    {
      "type": "WEB",
      "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10629"
    },
    {
      "type": "WEB",
      "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=KB29195"
    },
    {
      "type": "WEB",
      "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=KB29217"
    },
    {
      "type": "WEB",
      "url": "http://linux.oracle.com/errata/ELSA-2014-1053.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00030.html"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140266410314613\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140317760000786\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140369637402535\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140386311427810\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140389274407904\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140389355508263\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140431828824371\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140448122410568\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140482916501310\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140491231331543\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140499864129699\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140544599631400\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140604261522465\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140621259019789\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140672208601650\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140752315422991\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140784085708882\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140794476212181\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140852757108392\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140852826008699\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140870499402361\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140904544427729\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140983229106599\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141025641601169\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141147110427269\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141164638606214\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141383410222440\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141383465822787\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141658880509699\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=142350350616251\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=142546741516006\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=142805027510172\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://puppetlabs.com/security/cve/cve-2014-0224"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0624.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0626.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0627.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0630.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0631.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0632.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0633.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0680.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2014/Dec/23"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2014/Jun/38"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58128"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58337"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58385"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58433"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58492"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58579"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58615"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58639"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58660"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58667"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58713"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58714"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58716"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58719"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58742"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58743"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58745"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58759"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58930"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58939"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58945"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58977"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59004"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59012"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59040"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59043"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59055"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59063"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59093"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59101"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59120"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59126"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59132"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59135"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59142"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59162"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59163"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59167"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59175"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59186"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59188"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59189"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59190"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59191"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59192"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59202"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59211"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59214"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59215"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59223"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59231"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59264"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59282"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59284"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59287"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59300"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59301"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59305"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59306"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59310"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59325"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59338"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59342"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59347"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59354"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59362"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59364"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59365"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59368"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59370"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59374"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59375"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59380"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59383"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59389"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59413"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59429"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59435"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59437"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59438"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59440"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59441"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59442"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59444"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59445"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59446"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59447"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59448"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59449"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59450"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59451"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59454"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59459"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59460"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59483"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59490"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59491"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59495"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59502"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59506"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59514"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59518"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59525"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59528"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59529"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59530"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59589"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59602"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59655"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59659"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59661"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59666"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59669"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59677"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59721"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59784"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59824"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59827"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59878"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59885"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59894"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59916"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59990"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60049"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60066"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60176"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60522"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60567"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60571"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60577"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60819"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/61254"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/61815"
    },
    {
      "type": "WEB",
      "url": "http://security.gentoo.org/glsa/glsa-201407-05.xml"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT6443"
    },
    {
      "type": "WEB",
      "url": "http://support.citrix.com/article/CTX140876"
    },
    {
      "type": "WEB",
      "url": "http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15325.html"
    },
    {
      "type": "WEB",
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=isg400001841"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=isg400001843"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1020172"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004690"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV61506"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21673137"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675626"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675821"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676035"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676062"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676071"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676333"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676334"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676419"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676478"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676496"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676501"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676529"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676536"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676615"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676644"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676655"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676786"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676833"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676845"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676879"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676889"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677080"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677131"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677390"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677527"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677567"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677695"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677828"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677836"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678167"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678233"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678289"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21683332"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037727"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037729"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037730"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037731"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037732"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037761"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037870"
    },
    {
      "type": "WEB",
      "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095740"
    },
    {
      "type": "WEB",
      "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754"
    },
    {
      "type": "WEB",
      "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755"
    },
    {
      "type": "WEB",
      "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756"
    },
    {
      "type": "WEB",
      "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757"
    },
    {
      "type": "WEB",
      "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095737"
    },
    {
      "type": "WEB",
      "url": "http://www.blackberry.com/btsc/KB36051"
    },
    {
      "type": "WEB",
      "url": "http://www.f-secure.com/en/web/labs_global/fsc-2014-6"
    },
    {
      "type": "WEB",
      "url": "http://www.fortiguard.com/advisory/FG-IR-14-018"
    },
    {
      "type": "WEB",
      "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg3T1020948"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004678"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg1IT02314"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21676356"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21676793"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21676877"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg24037783"
    },
    {
      "type": "WEB",
      "url": "http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/978508"
    },
    {
      "type": "WEB",
      "url": "http://www.kerio.com/support/kerio-control/release-history"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:105"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:106"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:062"
    },
    {
      "type": "WEB",
      "url": "http://www.novell.com/support/kb/doc.php?id=7015264"
    },
    {
      "type": "WEB",
      "url": "http://www.novell.com/support/kb/doc.php?id=7015300"
    },
    {
      "type": "WEB",
      "url": "http://www.openssl.org/news/secadv_20140605.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1031032"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1031594"
    },
    {
      "type": "WEB",
      "url": "http://www.splunk.com/view/SP-CAAAM2D"
    },
    {
      "type": "WEB",
      "url": "http://www.tenable.com/blog/nessus-527-and-pvs-403-are-available-for-download"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/security/advisories/VMSA-2014-0006.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
    },
    {
      "type": "WEB",
      "url": "http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0"
    },
    {
      "type": "WEB",
      "url": "http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18\u0026ID=6060\u0026myns=phmc\u0026mync=E"
    },
    {
      "type": "WEB",
      "url": "http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18\u0026ID=6061\u0026myns=phmc\u0026mync=E"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-84JM-9GQ7-8QCH

Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-07-13 00:01
VLAI
Details

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 212785.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-38979"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-15T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 212785.",
  "id": "GHSA-84jm-9gq7-8qch",
  "modified": "2022-07-13T00:01:36Z",
  "published": "2022-05-24T19:20:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38979"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212785"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6516034"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-86R9-39J9-99WP

Vulnerability from github – Published: 2021-06-23 17:17 – Updated: 2021-05-20 16:54
VLAI
Summary
Elliptic Curve Key Disclosure in go-jose
Details

go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.

Severity
9.1 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "gopkg.in/square/go-jose.v1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/square/go-jose"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-9121"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-20T16:54:50Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.",
  "id": "GHSA-86r9-39j9-99wp",
  "modified": "2021-05-20T16:54:50Z",
  "published": "2021-06-23T17:17:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9121"
    },
    {
      "type": "WEB",
      "url": "https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/164590"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2020-0010"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2016/11/03/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Elliptic Curve Key Disclosure in go-jose"
}

GHSA-877X-WH4J-H3GM

Vulnerability from github – Published: 2022-05-14 03:50 – Updated: 2022-05-14 03:50
VLAI
Details

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 133557.

Severity
5.9 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-1664"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-01-04T17:29:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 133557.",
  "id": "GHSA-877x-wh4j-h3gm",
  "modified": "2022-05-14T03:50:24Z",
  "published": "2022-05-14T03:50:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1664"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/133557"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22012027"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/102470"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-87G3-RX63-RRCH

Vulnerability from github – Published: 2022-09-17 00:00 – Updated: 2025-06-03 21:30
VLAI
Details

The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-42949"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-16T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks.",
  "id": "GHSA-87g3-rx63-rrch",
  "modified": "2025-06-03T21:30:30Z",
  "published": "2022-09-17T00:00:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42949"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dhammon/HotelDruid-CVE-2021-42949"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dhammon/Security"
    },
    {
      "type": "WEB",
      "url": "https://www.hoteldruid.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-87P9-XF94-P7QH

Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2022-05-24 17:28
VLAI
Details

A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where entire source code path is displayed in the browser itself helping the attacker identify the code structure /app/elkarbackup/src/Binovo/ElkarBackupBundle/Controller/DefaultController.php

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-24925"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-09-15T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where entire source code path is displayed in the browser itself helping the attacker identify the code structure /app/elkarbackup/src/Binovo/ElkarBackupBundle/Controller/DefaultController.php",
  "id": "GHSA-87p9-xf94-p7qh",
  "modified": "2022-05-24T17:28:20Z",
  "published": "2022-05-24T17:28:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24925"
    },
    {
      "type": "WEB",
      "url": "https://vyshnavvizz.blogspot.com/2020/09/sensitive-information-disclosure-source.html"
    },
    {
      "type": "WEB",
      "url": "https://www.elkarbackup.org"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-88R9-VCJ8-625F

Vulnerability from github – Published: 2023-04-11 09:30 – Updated: 2024-04-04 03:23
VLAI
Details

Inadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker with an administrative privilege to apply a specially crafted Firmware update file, alter the information, cause a denial-of-service (DoS) condition, and/or execute arbitrary code. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-27389"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-11T09:15:00Z",
    "severity": "HIGH"
  },
  "details": "Inadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker with an administrative privilege to apply a specially crafted Firmware update file, alter the information, cause a denial-of-service (DoS) condition, and/or execute arbitrary code. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).",
  "id": "GHSA-88r9-vcj8-625f",
  "modified": "2024-04-04T03:23:48Z",
  "published": "2023-04-11T09:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27389"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU96198617"
    },
    {
      "type": "WEB",
      "url": "https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_cps_230317_en.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.contec.com/download/donwload-list/?itemid=a054b3eb-da97-40d0-9598-d7f5ff4239ec#firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.contec.com/download/donwload-list/?itemid=a1b33f0d-d32b-4549-9741-613cd37d5528#firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.contec.com/download/donwload-list/?itemid=f832c526-dcf6-4976-85aa-f536c15a8120#firmware"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-88VG-7C8F-H3PR

Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03
VLAI
Details

In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using man-in-the-middle attacks. Usage of unapproved SSH encryption protocols or cipher suites also violates the Data Protection TSR (Technical Security Requirements).

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-16499"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-26T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using man-in-the-middle attacks. Usage of unapproved SSH encryption protocols or cipher suites also violates the Data Protection TSR (Technical Security Requirements).",
  "id": "GHSA-88vg-7c8f-h3pr",
  "modified": "2022-05-24T19:03:18Z",
  "published": "2022-05-24T19:03:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16499"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1168196"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
Mitigation
Architecture and Design

Use an encryption scheme that is currently considered to be strong by experts in the field.

CAPEC-112: Brute Force

In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.

CAPEC-192: Protocol Analysis

An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network. While this type of analysis involves the analysis of a networking protocol inherently, it does not require the presence of an actual or physical network.

CAPEC-20: Encryption Brute Forcing

An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.

← Back to the CWE list