CWE-326 Archives - CVE Vulnerability

CVE-2018-9028

Sun, 26 Feb 2023 06:51:42 +0000

Weak cryptography used for passwords in CA Privileged Access Manager 2.x reduces the complexity for password cracking.

The post CVE-2018-9028 appeared first on CVE Vulnerability.

CVE-2018-7242

Sun, 26 Feb 2023 06:50:59 +0000

Vulnerable hash algorithms exists in Schneider Electric’s Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. The algorithm used to encrypt the password is vulnerable to hash collision attacks.

The post CVE-2018-7242 appeared first on CVE Vulnerability.

CVE-2018-6653

Sun, 26 Feb 2023 06:50:48 +0000

comforte SWAP 1049 through 1069 and 20.0.0 through 21.5.3 (as used in SSLOBJ on HPE NonStop SSL T0910, and in the comforte SecurCS, SecurFTP, SecurLib/SSL-AT, and SecurTN products), after executing the RELOAD CERTIFICATES command, does not ensure that clients use a strong TLS cipher suite, which makes it easier for remote attackers to defeat intended cryptographic protection mechanisms by sniffing the network. This is fixed in 21.6.0.

The post CVE-2018-6653 appeared first on CVE Vulnerability.

CVE-2018-6594

Sun, 26 Feb 2023 06:50:47 +0000

lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto’s ElGamal implementation.

The post CVE-2018-6594 appeared first on CVE Vulnerability.

CVE-2018-6635

Sun, 26 Feb 2023 06:50:47 +0000

System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions, aka SMGR-26896.

The post CVE-2018-6635 appeared first on CVE Vulnerability.

CVE-2018-5461

Sun, 26 Feb 2023 06:50:21 +0000

An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An inadequate encryption strength vulnerability in the web interface has been identified, which may allow an attacker to obtain sensitive information through a successful man-in-the-middle attack.

The post CVE-2018-5461 appeared first on CVE Vulnerability.

CVE-2018-5298

Sun, 26 Feb 2023 06:50:17 +0000

In the Procter & Gamble “Oral-B App” (aka com.pg.oralb.oralbapp) application 5.0.0 for Android, AES encryption with static parameters is used to secure the locally stored shared preferences. An attacker can gain access to locally stored user data more easily by leveraging access to the preferences XML file.

The post CVE-2018-5298 appeared first on CVE Vulnerability.

CVE-2018-5184

Sun, 26 Feb 2023 06:50:14 +0000

Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.

The post CVE-2018-5184 appeared first on CVE Vulnerability.

CVE-2018-4839

Sun, 26 Feb 2023 06:50:05 +0000

A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords.

The post CVE-2018-4839 appeared first on CVE Vulnerability.

CVE-2018-21080

Sun, 26 Feb 2023 06:48:52 +0000

An issue was discovered on Samsung mobile devices with N(7.x) software. A physically proximate attacker wielding a magnet can activate NFC to bypass the lockscreen. The Samsung ID is SVE-2017-10897 (March 2018).

The post CVE-2018-21080 appeared first on CVE Vulnerability.