Common Weakness Enumeration

CWE-326

Allowed-with-Review

Inadequate Encryption Strength

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

673 vulnerabilities reference this CWE, most recent first.

GHSA-7XHQ-2XXJ-QPP5

Vulnerability from github – Published: 2026-04-22 18:31 – Updated: 2026-04-22 18:31
VLAI
Details

ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM level permissions. Attackers can connect to the database using default connector credentials, decrypt the DBA password, and execute commands via the xp_cmdshell stored procedure or add backdoor users to the BEDIENER table.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-25272"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-22T16:16:48Z",
    "severity": "CRITICAL"
  },
  "details": "ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM level permissions. Attackers can connect to the database using default connector credentials, decrypt the DBA password, and execute commands via the xp_cmdshell stored procedure or add backdoor users to the BEDIENER table.",
  "id": "GHSA-7xhq-2xxj-qpp5",
  "modified": "2026-04-22T18:31:44Z",
  "published": "2026-04-22T18:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25272"
    },
    {
      "type": "WEB",
      "url": "https://www.elba.at"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45905"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/elba5-remote-code-execution-via-database-access"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-7XPV-834V-X9RJ

Vulnerability from github – Published: 2025-05-28 18:33 – Updated: 2025-05-28 18:33
VLAI
Details

IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-38341"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326",
      "CWE-328"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-28T16:15:32Z",
    "severity": "MODERATE"
  },
  "details": "IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.",
  "id": "GHSA-7xpv-834v-x9rj",
  "modified": "2025-05-28T18:33:27Z",
  "published": "2025-05-28T18:33:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38341"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7234888"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-837H-J995-V8PG

Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-07-31 00:00
VLAI
Details

A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encryption algorithm for storage of sensitive data, which may allow an attacker to more easily obtain credentials used for access.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-27457"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326",
      "CWE-327"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-20T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encryption algorithm for storage of sensitive data, which may allow an attacker to more easily obtain credentials used for access.",
  "id": "GHSA-837h-j995-v8pg",
  "modified": "2022-07-31T00:00:58Z",
  "published": "2022-05-24T19:02:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27457"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-138-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-83H9-VCQ9-FVWV

Vulnerability from github – Published: 2026-10-19 00:30 – Updated: 2026-10-19 00:30
VLAI
Details

A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The attack needs to be performed locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Severity
2.5 (Low)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
1.1 (Low)
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-112029"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-18T23:16:56Z",
    "severity": "LOW"
  },
  "details": "A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The attack needs to be performed locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
  "id": "GHSA-83h9-vcq9-fvwv",
  "modified": "2026-10-19T00:30:23Z",
  "published": "2026-10-19T00:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112029"
    },
    {
      "type": "WEB",
      "url": "https://github.com/diem-project/diem/issues/452"
    },
    {
      "type": "WEB",
      "url": "https://github.com/diem-project/diem"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-112029"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/1008077"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/421677"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/421677/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-84GM-V5WH-659W

Vulnerability from github – Published: 2022-05-13 01:05 – Updated: 2025-04-12 12:34
VLAI
Details

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2014-0224"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-06-05T21:55:00Z",
    "severity": "HIGH"
  },
  "details": "OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the \"CCS Injection\" vulnerability.",
  "id": "GHSA-84gm-v5wh-659w",
  "modified": "2025-04-12T12:34:39Z",
  "published": "2022-05-13T01:05:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0224"
    },
    {
      "type": "WEB",
      "url": "https://www.novell.com/support/kb/doc.php?id=7015271"
    },
    {
      "type": "WEB",
      "url": "https://www.intersectalliance.com/wp-content/uploads/release_notes/ReleaseNotes_for_Snare_for_Windows.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.intersectalliance.com/wp-content/uploads/release_notes/ReleaseNotes_for_SNARE_for_MSSQL.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.imperialviolet.org/2014/06/05/earlyccs.html"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/docview.wss?uid=ssg1S1004671"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/docview.wss?uid=ssg1S1004670"
    },
    {
      "type": "WEB",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/941-security-advisory-0005"
    },
    {
      "type": "WEB",
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10075"
    },
    {
      "type": "WEB",
      "url": "https://kb.bluecoat.com/index?page=content\u0026id=SA80"
    },
    {
      "type": "WEB",
      "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946"
    },
    {
      "type": "WEB",
      "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=bc8923b1ec9c467755cd86f7848c50ee8812e441"
    },
    {
      "type": "WEB",
      "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=bc8923b1ec9c467755cd86f7848c50ee8812e441"
    },
    {
      "type": "WEB",
      "url": "https://filezilla-project.org/versions.php?type=server"
    },
    {
      "type": "WEB",
      "url": "https://discussions.nessus.org/thread/7517"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103586"
    },
    {
      "type": "WEB",
      "url": "https://blogs.oracle.com/sunsecurity/entry/cve_2014_0224_cryptographic_issues1"
    },
    {
      "type": "WEB",
      "url": "https://blogs.oracle.com/sunsecurity/entry/cve_2014_0224_cryptographic_issues"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/site/blogs/766093/posts/908133"
    },
    {
      "type": "WEB",
      "url": "http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc"
    },
    {
      "type": "WEB",
      "url": "http://ccsinjection.lepidum.co.jp"
    },
    {
      "type": "WEB",
      "url": "http://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-1-7.html"
    },
    {
      "type": "WEB",
      "url": "http://esupport.trendmicro.com/solution/en-US/1103813.aspx"
    },
    {
      "type": "WEB",
      "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10629"
    },
    {
      "type": "WEB",
      "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=KB29195"
    },
    {
      "type": "WEB",
      "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=KB29217"
    },
    {
      "type": "WEB",
      "url": "http://linux.oracle.com/errata/ELSA-2014-1053.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00030.html"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140266410314613\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140317760000786\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140369637402535\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140386311427810\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140389274407904\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140389355508263\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140431828824371\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140448122410568\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140482916501310\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140491231331543\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140499864129699\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140544599631400\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140604261522465\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140621259019789\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140672208601650\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140752315422991\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140784085708882\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140794476212181\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140852757108392\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140852826008699\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140870499402361\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140904544427729\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=140983229106599\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141025641601169\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141147110427269\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141164638606214\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141383410222440\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141383465822787\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=141658880509699\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=142350350616251\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=142546741516006\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=142805027510172\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://puppetlabs.com/security/cve/cve-2014-0224"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0624.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0626.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0627.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0630.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0631.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0632.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0633.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0680.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2014/Dec/23"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2014/Jun/38"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58128"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58337"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58385"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58433"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58492"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58579"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58615"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58639"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58660"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58667"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58713"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58714"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58716"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58719"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58742"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58743"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58745"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58759"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58930"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58939"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58945"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58977"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59004"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59012"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59040"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59043"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59055"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59063"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59093"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59101"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59120"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59126"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59132"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59135"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59142"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59162"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59163"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59167"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59175"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59186"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59188"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59189"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59190"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59191"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59192"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59202"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59211"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59214"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59215"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59223"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59231"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59264"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59282"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59284"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59287"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59300"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59301"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59305"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59306"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59310"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59325"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59338"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59342"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59347"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59354"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59362"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59364"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59365"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59368"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59370"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59374"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59375"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59380"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59383"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59389"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59413"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59429"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59435"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59437"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59438"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59440"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59441"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59442"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59444"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59445"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59446"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59447"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59448"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59449"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59450"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59451"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59454"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59459"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59460"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59483"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59490"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59491"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59495"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59502"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59506"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59514"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59518"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59525"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59528"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59529"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59530"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59589"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59602"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59655"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59659"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59661"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59666"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59669"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59677"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59721"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59784"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59824"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59827"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59878"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59885"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59894"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59916"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59990"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60049"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60066"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60176"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60522"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60567"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60571"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60577"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60819"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/61254"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/61815"
    },
    {
      "type": "WEB",
      "url": "http://security.gentoo.org/glsa/glsa-201407-05.xml"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT6443"
    },
    {
      "type": "WEB",
      "url": "http://support.citrix.com/article/CTX140876"
    },
    {
      "type": "WEB",
      "url": "http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15325.html"
    },
    {
      "type": "WEB",
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140605-openssl"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=isg400001841"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=isg400001843"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1020172"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004690"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV61506"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21673137"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675626"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21675821"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676035"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676062"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676071"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676333"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676334"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676419"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676478"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676496"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676501"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676529"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676536"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676615"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676644"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676655"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676786"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676833"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676845"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676879"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676889"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677080"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677131"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677390"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677527"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677567"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677695"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677828"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677836"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678167"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678233"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21678289"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21683332"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037727"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037729"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037730"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037731"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037732"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037761"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24037870"
    },
    {
      "type": "WEB",
      "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095740"
    },
    {
      "type": "WEB",
      "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095754"
    },
    {
      "type": "WEB",
      "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095755"
    },
    {
      "type": "WEB",
      "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095756"
    },
    {
      "type": "WEB",
      "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095757"
    },
    {
      "type": "WEB",
      "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095737"
    },
    {
      "type": "WEB",
      "url": "http://www.blackberry.com/btsc/KB36051"
    },
    {
      "type": "WEB",
      "url": "http://www.f-secure.com/en/web/labs_global/fsc-2014-6"
    },
    {
      "type": "WEB",
      "url": "http://www.fortiguard.com/advisory/FG-IR-14-018"
    },
    {
      "type": "WEB",
      "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-345106.htm"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=isg3T1020948"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004678"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg1IT02314"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21676356"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21676793"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21676877"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg24037783"
    },
    {
      "type": "WEB",
      "url": "http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/978508"
    },
    {
      "type": "WEB",
      "url": "http://www.kerio.com/support/kerio-control/release-history"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:105"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:106"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:062"
    },
    {
      "type": "WEB",
      "url": "http://www.novell.com/support/kb/doc.php?id=7015264"
    },
    {
      "type": "WEB",
      "url": "http://www.novell.com/support/kb/doc.php?id=7015300"
    },
    {
      "type": "WEB",
      "url": "http://www.openssl.org/news/secadv_20140605.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1031032"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1031594"
    },
    {
      "type": "WEB",
      "url": "http://www.splunk.com/view/SP-CAAAM2D"
    },
    {
      "type": "WEB",
      "url": "http://www.tenable.com/blog/nessus-527-and-pvs-403-are-available-for-download"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/security/advisories/VMSA-2014-0006.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
    },
    {
      "type": "WEB",
      "url": "http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0"
    },
    {
      "type": "WEB",
      "url": "http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18\u0026ID=6060\u0026myns=phmc\u0026mync=E"
    },
    {
      "type": "WEB",
      "url": "http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18\u0026ID=6061\u0026myns=phmc\u0026mync=E"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-84JM-9GQ7-8QCH

Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-07-13 00:01
VLAI
Details

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 212785.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-38979"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-15T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 212785.",
  "id": "GHSA-84jm-9gq7-8qch",
  "modified": "2022-07-13T00:01:36Z",
  "published": "2022-05-24T19:20:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38979"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212785"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6516034"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-86R9-39J9-99WP

Vulnerability from github – Published: 2021-06-23 17:17 – Updated: 2021-05-20 16:54
VLAI
Summary
Elliptic Curve Key Disclosure in go-jose
Details

go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.

Severity
9.1 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "gopkg.in/square/go-jose.v1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/square/go-jose"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-9121"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-20T16:54:50Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.",
  "id": "GHSA-86r9-39j9-99wp",
  "modified": "2021-05-20T16:54:50Z",
  "published": "2021-06-23T17:17:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9121"
    },
    {
      "type": "WEB",
      "url": "https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/164590"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2020-0010"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2016/11/03/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Elliptic Curve Key Disclosure in go-jose"
}

GHSA-877X-WH4J-H3GM

Vulnerability from github – Published: 2022-05-14 03:50 – Updated: 2022-05-14 03:50
VLAI
Details

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 133557.

Severity
5.9 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-1664"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-01-04T17:29:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 133557.",
  "id": "GHSA-877x-wh4j-h3gm",
  "modified": "2022-05-14T03:50:24Z",
  "published": "2022-05-14T03:50:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1664"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/133557"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22012027"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/102470"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-87G3-RX63-RRCH

Vulnerability from github – Published: 2022-09-17 00:00 – Updated: 2025-06-03 21:30
VLAI
Details

The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-42949"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-16T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks.",
  "id": "GHSA-87g3-rx63-rrch",
  "modified": "2025-06-03T21:30:30Z",
  "published": "2022-09-17T00:00:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42949"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dhammon/HotelDruid-CVE-2021-42949"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dhammon/Security"
    },
    {
      "type": "WEB",
      "url": "https://www.hoteldruid.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-87P9-XF94-P7QH

Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2022-05-24 17:28
VLAI
Details

A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where entire source code path is displayed in the browser itself helping the attacker identify the code structure /app/elkarbackup/src/Binovo/ElkarBackupBundle/Controller/DefaultController.php

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-24925"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-326"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-09-15T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where entire source code path is displayed in the browser itself helping the attacker identify the code structure /app/elkarbackup/src/Binovo/ElkarBackupBundle/Controller/DefaultController.php",
  "id": "GHSA-87p9-xf94-p7qh",
  "modified": "2022-05-24T17:28:20Z",
  "published": "2022-05-24T17:28:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24925"
    },
    {
      "type": "WEB",
      "url": "https://vyshnavvizz.blogspot.com/2020/09/sensitive-information-disclosure-source.html"
    },
    {
      "type": "WEB",
      "url": "https://www.elkarbackup.org"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
Mitigation
Architecture and Design

Use an encryption scheme that is currently considered to be strong by experts in the field.

CAPEC-112: Brute Force

In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.

CAPEC-192: Protocol Analysis

An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network. While this type of analysis involves the analysis of a networking protocol inherently, it does not require the presence of an actual or physical network.

CAPEC-20: Encryption Brute Forcing

An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.

← Back to the CWE list