Most recent entries from all

bdu:2021-03140

certfr-2016-avi-320 — De multiples vulnérabilités ont été corrigées dans OpenSSL. Certaines d'entre elles permett…

certfr-2016-avi-320

cnvd-2016-06765

EUVD-2026-323019

fkie_cve-2016-2183

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

GHSA-w2rw-pv8p-h9c8

gsd-2016-2183

ICSA-21-075-02 — GE UR Family (Update A)

Prior to UR firmware Version 8.1x, UR supported various encryption and MAC algorithms for SSH communication, some of which are weak. The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. Prior to UR firmware Version 8.1x, UR supported various encryption and MAC algorithms for SSH communication, some of which are weak. The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext. Prior to firmware Version 7.4x, UR supported only SSHv2. Starting from firmware Version 7.4x, UR added support to SSHv1. SSHv1 has known vulnerabilities (SSH protocol session key retrieval and insertion attack). SSH 1.2.25, 1.2.23, and other versions, when used in in CBC (Cipher Block Chaining) or CFB (Cipher Feedback 64 bits) modes, allows remote attackers to insert arbitrary data into an existing stream between an SSH client and server by using a known plaintext attack and computing a valid CRC-32 checksum for the packet, aka the "SSH insertion attack." GE U…

jvndb-2023-000029

SkyBridge MB-A100/A110/A200/A130 SkySpider MB-R210 provided by Seiko Solutions Inc. contain multiple vulnerabilities listed below. <ul> <li>Exposure of sensitive information to an unauthorized actor (CWE-200) - CVE-2016-2183 <li>Command injection (CWE-77) - CVE-2022-36556 <li>Unrestricted upload of file with dangerous type (CWE-434) - CVE-2022-36557 <li>Use of hard-coded credentials (CWE-798) - CVE-2022-36558 <li>Command injection (CWE-77) - CVE-2022-36559 <li>Use of hard-coded credentials (CWE-798) - CVE-2022-36560 <li>Improper privilege management (CWE-269) - CVE-2023-22361 <li>Missing authentication for critical function (CWE-306) - CVE-2023-22441 <li>Improper access control (CWE-284) - CVE-2023-23578 <li>Improper following of a certificate's chain of trust (CWE-296) - CVE-2023-23901 <li>Missing authentication for critical function (CWE-306) - CVE-2023-23906 <li>Cleartext storage of sensitive information (CWE-312) - CVE-2023-24586 <li>Cleartext transmission of sensitive information (CWE-319) - CVE-2023-25070 <li>Use of weak credentials (CWE-1391) - CVE-2023-25072 <li>Use of weak credentials (CWE-1391) - CVE-2023-25184 </ul> The developer states that attacks exploiting CVE-2022-36556 have been observed. CVE-2023-22441 MASAHIRO IIDA of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2016-2183, CVE-2022-36556, CVE-2022-36557, CVE-2022-36558, CVE-20…

openSUSE-SU-2024:10247-1 — nodejs4-4.7.0-1.1 on GA media

nodejs4-4.7.0-1.1 on GA media

RHBA-2019:2581 — Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 images update

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

SUSE-SU-2016:2387-1 — Security update for openssl

Security update for openssl

UBUNTU-CVE-2016-2183

Affected: Ubuntu:14.04:LTS: nss, Ubuntu:14.04:LTS: openjdk-6, Ubuntu:14.04:LTS: openjdk-7, Ubuntu:14.04:LTS: openssl, Ubuntu:16.04:LTS: nss, Ubuntu:16.04:LTS: openjdk-8, Ubuntu:16.04:LTS: openssl

VDE-2025-023 — Weidmueller: OpenSSL vulnerability in industrial ethernet switches

Multiple Weidmueller products are affected by an OpenSSL vulnerability.

Weidmüller has released new firmwares of the affected products to fix the vulnerability.

VDE-2025-078 — TRUMPF: Remote support uses an outdated encryption algorithm

The TRUMPF remote support infrastructure selects an outdated encryption algorithm when setting up communication channels for machines. This cannot be prevented for old machines. For most machines it is possible to change the encryption settings.

VDE-2026-013 — Helmholz: Use of a Broken or Risky Cryptographic Algorithm

Vulnerabilities in PROFINET-Switch devices with firmware <= V1.12.010 that allow an attacker to gain control over the device.

WID-SEC-W-2022-1955 — OpenSSL: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um Sicherheitsvorkehrungen zu umgehen.