Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
37 vulnerabilities by Thalesgroup
CVE-2026-6805 (GCVE-0-2026-6805)
Vulnerability from nvd – Published: 2026-05-07 09:45 – Updated: 2026-05-07 13:39
VLAI
EPSS
VEX
Title
Vulnerability on Cryptobox external sharing feature
Summary
Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server allowing an offline brute-force attack of the access code associated to this sharing link.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-07 13:39 UTC
CWE
- CWE-280 - Improper handling of insufficient permissions or privileges
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://info.cryptobox.com/doc/v4.40/4.40.en/ | release-notes |
Impacted products
Date Public
2026-05-07 09:42
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6805",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-07T13:39:28.055891Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T13:39:33.124Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"modules": [
"Server"
],
"product": "Cryptobox",
"vendor": "Ercom",
"versions": [
{
"status": "unaffected",
"version": "4.40.183"
},
{
"lessThan": "v4.38.0",
"status": "unaffected",
"version": "4.37.248",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-05-07T09:42:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server allowing an offline brute-force attack of the access code associated to this sharing link.\u003cbr\u003e"
}
],
"value": "Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server allowing an offline brute-force attack of the access code associated to this sharing link."
}
],
"impacts": [
{
"capecId": "CAPEC-49",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-49 Password Brute Forcing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-280",
"description": "CWE-280 Improper handling of insufficient permissions or privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T09:45:42.841Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://info.cryptobox.com/doc/v4.40/4.40.en/"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Vulnerability on Cryptobox external sharing feature",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-6805",
"datePublished": "2026-05-07T09:45:42.841Z",
"dateReserved": "2026-04-21T15:15:08.431Z",
"dateUpdated": "2026-05-07T13:39:33.124Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3457 (GCVE-0-2026-3457)
Vulnerability from nvd – Published: 2026-03-27 09:05 – Updated: 2026-09-03 15:44
VLAI
EPSS
VEX
Title
Stored XSS vulnerability in Sentinel ACC
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Thales Sentinel LDK Runtime on Windows allows Stored XSS.
This issue affects Sentinel LDK Runtime: before 10.22.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-27 13:06 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://supportportal.thalesgroup.com/csm?id=kb_a… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thalesgroup | Sentinel LDK Runtime |
Affected:
0 , < 10.22
(custom)
cpe:2.3:a:thalesgroup:sentinel_ldk_runtime:*:*:windows:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3457",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T13:06:20.772171Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T13:45:21.259Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Sentinel LDK Runtime",
"vendor": "Thalesgroup",
"versions": [
{
"lessThan": "10.22",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:thalesgroup:sentinel_ldk_runtime:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "10.22",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Josh Dillon"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Thales Sentinel LDK Runtime on Windows allows Stored XSS.\u003cp\u003eThis issue affects Sentinel LDK Runtime: before 10.22.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Thales Sentinel LDK Runtime on Windows allows Stored XSS.\n\nThis issue affects Sentinel LDK Runtime: before 10.22."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:44:12.227Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=5c18186b478aa950128dca72e36d4391\u0026sysparm_article=KB0027106"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade current Sentinel\nLDK Runtime to version 10.22 or higher."
}
],
"value": "Upgrade current Sentinel\nLDK Runtime to version 10.22 or higher."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored XSS vulnerability in Sentinel ACC",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-3457",
"datePublished": "2026-03-27T09:05:48.226Z",
"dateReserved": "2026-03-02T19:33:17.694Z",
"dateUpdated": "2026-09-03T15:44:12.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0872 (GCVE-0-2026-0872)
Vulnerability from nvd – Published: 2026-02-13 08:53 – Updated: 2026-09-03 15:59
VLAI
EPSS
VEX
Title
Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon
Summary
Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon on Windows allows Signature Spoofing by Improper Validation.
This issue affects SafeNet Agent for Windows Logon: 4.0.0, 4.1.1, 4.1.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-13 12:47 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://thalesdocs.com/sta/agents/wla-windows_log… | mitigation |
| https://supportportal.thalesgroup.com/csm?sys_kb_… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thalesgroup | SafeNet Agent for Windows Logon |
Affected:
4.0.0
Affected: 4.1.1 Affected: 4.1.2 cpe:2.3:a:thalesgroup:safenet_agent_for_windows_logon:4.0.0:*:windows:*:*:*:*:* cpe:2.3:a:thalesgroup:safenet_agent_for_windows_logon:4.1.1:*:windows:*:*:*:*:* cpe:2.3:a:thalesgroup:safenet_agent_for_windows_logon:4.1.2:*:windows:*:*:*:*:* |
Date Public
2026-02-08 08:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0872",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-13T12:47:11.793545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-13T12:47:30.747Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SafeNet Agent for Windows Logon",
"vendor": "Thalesgroup",
"versions": [
{
"status": "affected",
"version": "4.0.0"
},
{
"status": "affected",
"version": "4.1.1"
},
{
"status": "affected",
"version": "4.1.2"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:thalesgroup:safenet_agent_for_windows_logon:4.0.0:*:windows:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:thalesgroup:safenet_agent_for_windows_logon:4.1.1:*:windows:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:thalesgroup:safenet_agent_for_windows_logon:4.1.2:*:windows:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Huy Kha, Director of Security Research, and the team at Netwrix"
}
],
"datePublic": "2026-02-08T08:52:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon on Windows allows Signature Spoofing by Improper Validation.\u003cp\u003eThis issue affects SafeNet Agent for Windows Logon: 4.0.0, 4.1.1, 4.1.2.\u003c/p\u003e"
}
],
"value": "Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon on Windows allows Signature Spoofing by Improper Validation.\n\nThis issue affects SafeNet Agent for Windows Logon: 4.0.0, 4.1.1, 4.1.2."
}
],
"impacts": [
{
"capecId": "CAPEC-475",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-475 Signature Spoofing by Improper Validation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.5,
"baseSeverity": "LOW",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:59:17.919Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"mitigation"
],
"url": "https://thalesdocs.com/sta/agents/wla-windows_logon/wla-preinstallation_passwordless/index.html"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://supportportal.thalesgroup.com/csm?sys_kb_id=247fd4a42b4a7290061af3f5f291bff1\u0026id=kb_article_view\u0026sysparm_rank=1\u0026sysparm_tsqueryId=5ecb72c73b927610381ecfaf55e45a0b\u0026sysparm_article=KB0030173"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to version 4.1.3."
}
],
"value": "Upgrade to version 4.1.3."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-0872",
"datePublished": "2026-02-13T08:53:05.621Z",
"dateReserved": "2026-01-13T09:32:05.991Z",
"dateUpdated": "2026-09-03T15:59:17.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-5264 (GCVE-0-2024-5264)
Vulnerability from nvd – Published: 2024-05-23 08:40 – Updated: 2024-08-01 21:11
VLAI
EPSS
VEX
Title
Network Key Transfer with AES KHT vulnerability in Luna EFT
Summary
Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-12 20:41 UTC
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | Luna EFT |
Affected:
2.1.0
|
|
| thalesgroup | luna_eft |
Affected:
2.1 , ≤ *
(custom)
cpe:2.3:a:thalesgroup:luna_eft:2.1:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:thalesgroup:luna_eft:2.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "luna_eft",
"vendor": "thalesgroup",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "2.1",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T20:41:30.681683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T20:41:33.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:11.016Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=50da3cd9c302c218204e2a6ce00131b9\u0026sysparm_article=KB0028531"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Network Key Transfer with AES KHT"
],
"platforms": [
"Appliance"
],
"product": "Luna EFT",
"vendor": "Thales",
"versions": [
{
"status": "affected",
"version": "2.1.0"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Network Transfer with AES KHT"
}
],
"value": "Network Transfer with AES KHT"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Cory Whitesell, Sr. Security Engineer, Transaction Network Services"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis"
}
],
"value": "Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis"
}
],
"impacts": [
{
"capecId": "CAPEC-20",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-20 Encryption Brute Forcing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-23T08:40:56.239Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=50da3cd9c302c218204e2a6ce00131b9\u0026sysparm_article=KB0028531"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Network Key Transfer with AES KHT vulnerability in Luna EFT",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Disable functionality in the console - see linked bulletin"
}
],
"value": "Disable functionality in the console - see linked bulletin"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2024-5264",
"datePublished": "2024-05-23T08:40:56.239Z",
"dateReserved": "2024-05-23T08:39:05.391Z",
"dateUpdated": "2024-08-01T21:11:11.016Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0197 (GCVE-0-2024-0197)
Vulnerability from nvd – Published: 2024-02-27 12:48 – Updated: 2024-08-09 15:26
VLAI
EPSS
VEX
Title
Privilege Escalation in Thales SafeNet Sentinel HASP LDK
Summary
A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-01 17:56 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | Sentinel HASP LDK |
Affected:
0 , < 9.16
(9.16)
|
|
| thalesgroup | safenet_sentinel_hasp |
Affected:
0 , < 9.16
(custom)
cpe:2.3:a:thalesgroup:safenet_sentinel_hasp:*:*:*:*:*:*:*:* |
|
| thalesgroup | safenet_sentinel_ldk |
Affected:
0 , ≤ 9.16
(custom)
cpe:2.3:a:thalesgroup:safenet_sentinel_ldk:*:*:*:*:*:*:*:* |
Date Public
2024-02-15 23:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T17:41:16.069Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://supportportal.thalesgroup.com"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:thalesgroup:safenet_sentinel_hasp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "safenet_sentinel_hasp",
"vendor": "thalesgroup",
"versions": [
{
"lessThan": "9.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:thalesgroup:safenet_sentinel_ldk:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "safenet_sentinel_ldk",
"vendor": "thalesgroup",
"versions": [
{
"lessThanOrEqual": "9.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-01T17:56:38.989974Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-09T15:26:44.274Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Sentinel HASP LDK",
"vendor": "Thales",
"versions": [
{
"lessThan": "9.16",
"status": "affected",
"version": "0",
"versionType": "9.16"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Julian Horoszkiewicz (Eviden Red Team)"
}
],
"datePublic": "2024-02-15T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.\n\n"
}
],
"value": "A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-27T12:48:13.263Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"url": "https://supportportal.thalesgroup.com"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Thales Sentinel LDK version 9.16.\u003cbr\u003e"
}
],
"value": "Upgrade to Thales Sentinel LDK version 9.16.\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Privilege Escalation in Thales SafeNet Sentinel HASP LDK",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2024-0197",
"datePublished": "2024-02-27T12:48:13.263Z",
"dateReserved": "2024-01-02T15:23:33.572Z",
"dateUpdated": "2024-08-09T15:26:44.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-7016 (GCVE-0-2023-7016)
Vulnerability from nvd – Published: 2024-02-27 10:45 – Updated: 2024-08-15 18:53
VLAI
EPSS
VEX
Title
Privilege Escalation in SafeNet Authentication Client
Summary
A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-27 15:17 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | SafeNet Authentication Client |
Affected:
0 , < 10.8
(patch 10)
|
|
| thalesgroup | safenet_authentication_client |
Affected:
0 , < 10.8
(custom)
cpe:2.3:a:thalesgroup:safenet_authentication_client:*:*:*:*:*:*:*:* |
Date Public
2024-02-18 23:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:50:07.630Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://supportportal.thalesgroup.com"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:thalesgroup:safenet_authentication_client:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "safenet_authentication_client",
"vendor": "thalesgroup",
"versions": [
{
"lessThan": "10.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-7016",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-27T15:17:31.490247Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T18:53:46.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SafeNet Authentication Client",
"vendor": "Thales",
"versions": [
{
"lessThan": "10.8",
"status": "affected",
"version": "0",
"versionType": "patch 10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Kravets Vasiliy, xi-tauw@xi-tauw.info"
}
],
"datePublic": "2024-02-18T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access."
}
],
"value": "A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-27T10:45:28.333Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"url": "https://supportportal.thalesgroup.com"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to the current SafeNet Authentication Client 10.8 R10 (GA).\u003cbr\u003e"
}
],
"value": "Upgrade to the current SafeNet Authentication Client 10.8 R10 (GA).\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Privilege Escalation in SafeNet Authentication Client ",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2023-7016",
"datePublished": "2024-02-27T10:45:28.333Z",
"dateReserved": "2023-12-20T15:48:00.568Z",
"dateUpdated": "2024-08-15T18:53:46.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5993 (GCVE-0-2023-5993)
Vulnerability from nvd – Published: 2024-02-27 10:42 – Updated: 2024-08-08 19:28
VLAI
EPSS
VEX
Title
Privilege Escalation in SafeNet Authentication Client Installer
Summary
A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-27 15:39 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | SafeNet Authentication Client |
Affected:
0 , < 10.8
(patch 10)
|
|
| thalesgroup | safenet_authentication_client |
Affected:
0 , < 10.8
(custom)
cpe:2.3:a:thalesgroup:safenet_authentication_client:*:*:*:*:*:*:*:* |
Date Public
2024-02-18 23:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:14:25.122Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://supportportal.thalesgroup.com"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:thalesgroup:safenet_authentication_client:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "safenet_authentication_client",
"vendor": "thalesgroup",
"versions": [
{
"lessThan": "10.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5993",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-27T15:39:53.382676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T19:28:36.205Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SafeNet Authentication Client",
"vendor": "Thales",
"versions": [
{
"lessThan": "10.8",
"status": "affected",
"version": "0",
"versionType": "patch 10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Kravets Vasiliy, xi-tauw@xi-tauw.info"
}
],
"datePublic": "2024-02-18T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access."
}
],
"value": "A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-27T10:42:08.287Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"url": "https://supportportal.thalesgroup.com"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to the current SafeNet Authentication Client 10.8 R10 (GA)."
}
],
"value": "Upgrade to the current SafeNet Authentication Client 10.8 R10 (GA)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Privilege Escalation in SafeNet Authentication Client Installer",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2023-5993",
"datePublished": "2024-02-27T10:42:08.287Z",
"dateReserved": "2023-11-07T16:29:48.850Z",
"dateUpdated": "2024-08-08T19:28:36.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-2737 (GCVE-0-2023-2737)
Vulnerability from nvd – Published: 2023-08-16 15:45 – Updated: 2024-10-01 18:19
VLAI
EPSS
VEX
Title
Improper securing of log directory may allow a denial of service
Summary
Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-01 18:13 UTC
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | SafeNet Authtentication Service Agent |
Affected:
SafeNet Authentication Service Agent , < 3.6.1
(3.6.0)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:33:05.388Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=08f460ba47bba550c0e42e61e36d432f\u0026sysparm_article=KB0027485"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-2737",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-01T18:13:42.811602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-01T18:19:57.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SafeNet Authtentication Service Agent",
"vendor": "Thales",
"versions": [
{
"lessThan": "3.6.1",
"status": "affected",
"version": "SafeNet Authentication Service Agent ",
"versionType": "3.6.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Florian Hansemann, https://hansesecure.de"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper log permissions in SafeNet Authentication Service\u0026nbsp;Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation.\u003cbr\u003e"
}
],
"value": "Improper log permissions in SafeNet Authentication Service\u00a0Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation.\n"
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-16T15:45:29.540Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=08f460ba47bba550c0e42e61e36d432f\u0026sysparm_article=KB0027485"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper securing of log directory may allow a denial of service",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2023-2737",
"datePublished": "2023-08-16T15:45:29.540Z",
"dateReserved": "2023-05-16T13:48:23.279Z",
"dateUpdated": "2024-10-01T18:19:57.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1293 (GCVE-0-2022-1293)
Vulnerability from nvd – Published: 2022-08-02 15:24 – Updated: 2024-09-16 23:46
VLAI
EPSS
VEX
Title
XSS vulnerability in Citadel
Summary
The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.
Severity
5.7 (Medium)
CWE
- CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ercom.com/security-updates | x_refsource_MISC |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | Citadel Web Client |
Affected:
7.1.1 , < 7.1.2
(custom)
|
|
| Thales | Citadel Macosx Desktop Client |
Affected:
7.1.1 , < 7.1.2
(custom)
|
|
| Thales | Citadel Windows Desktop Client |
Affected:
7.1.1 , < 7.1.2
(custom)
|
Date Public
2022-08-01 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:55:24.610Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.ercom.com/security-updates"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Web Client"
],
"product": "Citadel Web Client",
"vendor": "Thales",
"versions": [
{
"lessThan": "7.1.2",
"status": "affected",
"version": "7.1.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"Macosx"
],
"product": "Citadel Macosx Desktop Client",
"vendor": "Thales",
"versions": [
{
"lessThan": "7.1.2",
"status": "affected",
"version": "7.1.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"Windows"
],
"product": "Citadel Windows Desktop Client",
"vendor": "Thales",
"versions": [
{
"lessThan": "7.1.2",
"status": "affected",
"version": "7.1.1",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-08-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-09T17:56:59.000Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ercom.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 7.1.2"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "XSS vulnerability in Citadel",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@thalesgroup.com",
"DATE_PUBLIC": "2022-08-01T00:00:00.000Z",
"ID": "CVE-2022-1293",
"STATE": "PUBLIC",
"TITLE": "XSS vulnerability in Citadel"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Citadel Web Client",
"version": {
"version_data": [
{
"platform": "Web Client",
"version_affected": "\u003c",
"version_name": "7.1.1",
"version_value": "7.1.2"
}
]
}
},
{
"product_name": "Citadel Macosx Desktop Client",
"version": {
"version_data": [
{
"platform": "Macosx",
"version_affected": "\u003c",
"version_name": "7.1.1",
"version_value": "7.1.2"
}
]
}
},
{
"product_name": "Citadel Windows Desktop Client",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "\u003c",
"version_name": "7.1.1",
"version_value": "7.1.2"
}
]
}
}
]
},
"vendor_name": "Thales"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ercom.com/security-updates",
"refsource": "MISC",
"url": "https://www.ercom.com/security-updates"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 7.1.2"
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2022-1293",
"datePublished": "2022-08-02T15:24:27.869Z",
"dateReserved": "2022-04-11T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:46:35.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42056 (GCVE-0-2021-42056)
Vulnerability from nvd – Published: 2022-06-24 16:14 – Updated: 2024-08-04 03:22
VLAI
EPSS
VEX
Summary
Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:22:25.925Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-24T16:14:23.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-42056",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056",
"refsource": "MISC",
"url": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-42056",
"datePublished": "2022-06-24T16:14:23.000Z",
"dateReserved": "2021-10-07T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:22:25.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42811 (GCVE-0-2021-42811)
Vulnerability from nvd – Published: 2022-06-10 10:20 – Updated: 2024-09-16 21:08
VLAI
EPSS
VEX
Title
Vulnerability in SafeNet KeySecure
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://supportportal.thalesgroup.com/csm?id=kb_a… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales DIS | SafeNet KeySecure |
Affected:
8.12.4 , ≤ 8.12.4
(custom)
|
Date Public
2022-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:38:50.209Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=9278cada973f45509fd638d3f153afff\u0026sysparm_article=KB0025953"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SafeNet KeySecure",
"vendor": "Thales DIS",
"versions": [
{
"lessThanOrEqual": "8.12.4",
"status": "affected",
"version": "8.12.4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "We thank the Dell Security Assurance Team for reporting these vulnerabilities."
}
],
"datePublic": "2022-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-10T10:20:32.000Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=9278cada973f45509fd638d3f153afff\u0026sysparm_article=KB0025953"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 8.12.5 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Vulnerability in SafeNet KeySecure",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@thalesgroup.com",
"DATE_PUBLIC": "2022-06-09T00:00:00.000Z",
"ID": "CVE-2021-42811",
"STATE": "PUBLIC",
"TITLE": "Vulnerability in SafeNet KeySecure"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SafeNet KeySecure",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "8.12.4",
"version_value": "8.12.4"
}
]
}
}
]
},
"vendor_name": "Thales DIS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "We thank the Dell Security Assurance Team for reporting these vulnerabilities."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=9278cada973f45509fd638d3f153afff\u0026sysparm_article=KB0025953",
"refsource": "MISC",
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=9278cada973f45509fd638d3f153afff\u0026sysparm_article=KB0025953"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 8.12.5 or later."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2021-42811",
"datePublished": "2022-06-10T10:20:32.246Z",
"dateReserved": "2021-10-21T00:00:00.000Z",
"dateUpdated": "2024-09-16T21:08:15.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42810 (GCVE-0-2021-42810)
Vulnerability from nvd – Published: 2022-01-19 17:12 – Updated: 2024-09-17 01:41
VLAI
EPSS
VEX
Title
Safenet Authentication Service Remote Desktop Gateway prior to 2.0.3 may allow privilege escilation to authenticated users
Summary
A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed.
Severity
7.8 (High)
CWE
- CWE-336 - Same Seed in Pseudo-Random Number Generator (PRNG)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cpl.thalesgroup.com/support/security-updates | x_refsource_MISC |
| https://github.com/mandiant/Vulnerability-Disclos… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | SafeNet Authentication Service |
Affected:
Remote Desktop Gateway , < 2.0.3
(custom)
|
Date Public
2022-01-19 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:38:50.228Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cpl.thalesgroup.com/support/security-updates"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0002/MNDT-2022-0002.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SafeNet Authentication Service",
"vendor": "Thales",
"versions": [
{
"lessThan": "2.0.3",
"status": "affected",
"version": "Remote Desktop Gateway",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ronnie Salomonsen, Mandiant"
}
],
"datePublic": "2022-01-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-336",
"description": "CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-24T18:48:10.000Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cpl.thalesgroup.com/support/security-updates"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0002/MNDT-2022-0002.md"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Safenet Authentication Service Remote Desktop Gateway to version 2.0.3 or newer."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Safenet Authentication Service Remote Desktop Gateway prior to 2.0.3 may allow privilege escilation to authenticated users",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@thalesgroup.com",
"DATE_PUBLIC": "2022-01-19T00:00:00.000Z",
"ID": "CVE-2021-42810",
"STATE": "PUBLIC",
"TITLE": "Safenet Authentication Service Remote Desktop Gateway prior to 2.0.3 may allow privilege escilation to authenticated users"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SafeNet Authentication Service",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Remote Desktop Gateway",
"version_value": "2.0.3"
}
]
}
}
]
},
"vendor_name": "Thales"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Ronnie Salomonsen, Mandiant"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cpl.thalesgroup.com/support/security-updates",
"refsource": "MISC",
"url": "https://cpl.thalesgroup.com/support/security-updates"
},
{
"name": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0002/MNDT-2022-0002.md",
"refsource": "MISC",
"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0002/MNDT-2022-0002.md"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Safenet Authentication Service Remote Desktop Gateway to version 2.0.3 or newer."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2021-42810",
"datePublished": "2022-01-19T17:12:02.882Z",
"dateReserved": "2021-10-21T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:41:35.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42809 (GCVE-0-2021-42809)
Vulnerability from nvd – Published: 2021-12-20 20:19 – Updated: 2024-08-04 03:38
VLAI
EPSS
VEX
Title
The Sentinel Protection Installer 7.7.0 does not properly restrict loading Dynamic Link Library
Summary
Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code.
Severity
6.5 (Medium)
CWE
- CWE-913 - Improper Control of Dynamically-Managed Code Resources
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cpl.thalesgroup.com/fr/software-monetizat… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | Sentinel Protection Installer |
Affected:
7.7.0 , ≤ 7.7.0
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:38:50.212Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cpl.thalesgroup.com/fr/software-monetization/security-updates"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "Sentinel Protection Installer",
"vendor": "Thales",
"versions": [
{
"lessThanOrEqual": "7.7.0",
"status": "affected",
"version": "7.7.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Intel Corp"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-913",
"description": "CWE-913 Improper Control of Dynamically-Managed Code Resources",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-20T20:19:09.000Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cpl.thalesgroup.com/fr/software-monetization/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Sentinel Protection Installer to version 7.7.1 or newer."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "The Sentinel Protection Installer 7.7.0 does not properly restrict loading Dynamic Link Library",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@thalesgroup.com",
"ID": "CVE-2021-42809",
"STATE": "PUBLIC",
"TITLE": "The Sentinel Protection Installer 7.7.0 does not properly restrict loading Dynamic Link Library"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Sentinel Protection Installer",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "\u003c=",
"version_name": "7.7.0",
"version_value": "7.7.0"
}
]
}
}
]
},
"vendor_name": "Thales"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Intel Corp"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-913 Improper Control of Dynamically-Managed Code Resources"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cpl.thalesgroup.com/fr/software-monetization/security-updates",
"refsource": "MISC",
"url": "https://cpl.thalesgroup.com/fr/software-monetization/security-updates"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Sentinel Protection Installer to version 7.7.1 or newer."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2021-42809",
"datePublished": "2021-12-20T20:19:09.000Z",
"dateReserved": "2021-10-21T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:38:50.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42808 (GCVE-0-2021-42808)
Vulnerability from nvd – Published: 2021-12-20 20:19 – Updated: 2024-08-04 03:38
VLAI
EPSS
VEX
Title
The Sentinel Protection Installer 7.7.0 creates files and directory with all privileges granting any user full permissions.
Summary
Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges.
Severity
6.5 (Medium)
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cpl.thalesgroup.com/fr/software-monetizat… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | Sentinel Protection Installer |
Affected:
7.7.0 , ≤ 7.7.0
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:38:50.145Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cpl.thalesgroup.com/fr/software-monetization/security-updates"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "Sentinel Protection Installer",
"vendor": "Thales",
"versions": [
{
"lessThanOrEqual": "7.7.0",
"status": "affected",
"version": "7.7.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Intel Corp"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-20T20:19:10.000Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cpl.thalesgroup.com/fr/software-monetization/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Sentinel Protection Installer to version 7.7.1 or newer."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "The Sentinel Protection Installer 7.7.0 creates files and directory with all privileges granting any user full permissions.",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@thalesgroup.com",
"ID": "CVE-2021-42808",
"STATE": "PUBLIC",
"TITLE": "The Sentinel Protection Installer 7.7.0 creates files and directory with all privileges granting any user full permissions."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Sentinel Protection Installer",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "\u003c=",
"version_name": "7.7.0",
"version_value": "7.7.0"
}
]
}
}
]
},
"vendor_name": "Thales"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Intel Corp"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284 Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cpl.thalesgroup.com/fr/software-monetization/security-updates",
"refsource": "MISC",
"url": "https://cpl.thalesgroup.com/fr/software-monetization/security-updates"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Sentinel Protection Installer to version 7.7.1 or newer."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2021-42808",
"datePublished": "2021-12-20T20:19:10.000Z",
"dateReserved": "2021-10-21T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:38:50.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42138 (GCVE-0-2021-42138)
Vulnerability from nvd – Published: 2021-12-20 20:19 – Updated: 2024-08-04 03:30
VLAI
EPSS
VEX
Summary
A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine.
Severity
7.2 (High)
CWE
- https://cwe.mitre.org/data/definitions/336.html
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://supportportal.gemalto.com/csm?sys_kb_id=a… | x_refsource_MISC |
| https://supportportal.gemalto.com/csm?sys_kb_id=e… | x_refsource_MISC |
| https://cpl.thalesgroup.com/support/security-updates | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales CPL | Safenet Authentication Service |
Affected:
Windows Logon Agent , < 3.4.4
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:30:37.956Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://supportportal.gemalto.com/csm?sys_kb_id=a52bd13adbff7010f0e322080596194a\u0026id=kb_article_view\u0026sysparm_rank=1\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://supportportal.gemalto.com/csm?sys_kb_id=e8397662dbb7fc10520c4705059619eb\u0026id=kb_article_view\u0026sysparm_rank=2\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cpl.thalesgroup.com/support/security-updates"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Safenet Authentication Service",
"vendor": "Thales CPL",
"versions": [
{
"lessThan": "3.4.4",
"status": "affected",
"version": "Windows Logon Agent",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "compass-security"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "https://cwe.mitre.org/data/definitions/336.html",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-20T20:19:10.000Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://supportportal.gemalto.com/csm?sys_kb_id=a52bd13adbff7010f0e322080596194a\u0026id=kb_article_view\u0026sysparm_rank=1\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://supportportal.gemalto.com/csm?sys_kb_id=e8397662dbb7fc10520c4705059619eb\u0026id=kb_article_view\u0026sysparm_rank=2\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cpl.thalesgroup.com/support/security-updates"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@thalesgroup.com",
"ID": "CVE-2021-42138",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Safenet Authentication Service",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Windows Logon Agent",
"version_value": "3.4.4"
}
]
}
}
]
},
"vendor_name": "Thales CPL"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "compass-security"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "https://cwe.mitre.org/data/definitions/336.html"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://supportportal.gemalto.com/csm?sys_kb_id=a52bd13adbff7010f0e322080596194a\u0026id=kb_article_view\u0026sysparm_rank=1\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955",
"refsource": "MISC",
"url": "https://supportportal.gemalto.com/csm?sys_kb_id=a52bd13adbff7010f0e322080596194a\u0026id=kb_article_view\u0026sysparm_rank=1\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955"
},
{
"name": "https://supportportal.gemalto.com/csm?sys_kb_id=e8397662dbb7fc10520c4705059619eb\u0026id=kb_article_view\u0026sysparm_rank=2\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955",
"refsource": "MISC",
"url": "https://supportportal.gemalto.com/csm?sys_kb_id=e8397662dbb7fc10520c4705059619eb\u0026id=kb_article_view\u0026sysparm_rank=2\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955"
},
{
"name": "https://cpl.thalesgroup.com/support/security-updates",
"refsource": "MISC",
"url": "https://cpl.thalesgroup.com/support/security-updates"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2021-42138",
"datePublished": "2021-12-20T20:19:10.000Z",
"dateReserved": "2021-10-11T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:30:37.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-6805 (GCVE-0-2026-6805)
Vulnerability from cvelistv5 – Published: 2026-05-07 09:45 – Updated: 2026-05-07 13:39
VLAI
EPSS
VEX
Title
Vulnerability on Cryptobox external sharing feature
Summary
Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server allowing an offline brute-force attack of the access code associated to this sharing link.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-07 13:39 UTC
CWE
- CWE-280 - Improper handling of insufficient permissions or privileges
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://info.cryptobox.com/doc/v4.40/4.40.en/ | release-notes |
Impacted products
Date Public
2026-05-07 09:42
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6805",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-07T13:39:28.055891Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T13:39:33.124Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"modules": [
"Server"
],
"product": "Cryptobox",
"vendor": "Ercom",
"versions": [
{
"status": "unaffected",
"version": "4.40.183"
},
{
"lessThan": "v4.38.0",
"status": "unaffected",
"version": "4.37.248",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-05-07T09:42:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server allowing an offline brute-force attack of the access code associated to this sharing link.\u003cbr\u003e"
}
],
"value": "Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server allowing an offline brute-force attack of the access code associated to this sharing link."
}
],
"impacts": [
{
"capecId": "CAPEC-49",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-49 Password Brute Forcing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-280",
"description": "CWE-280 Improper handling of insufficient permissions or privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T09:45:42.841Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://info.cryptobox.com/doc/v4.40/4.40.en/"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Vulnerability on Cryptobox external sharing feature",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-6805",
"datePublished": "2026-05-07T09:45:42.841Z",
"dateReserved": "2026-04-21T15:15:08.431Z",
"dateUpdated": "2026-05-07T13:39:33.124Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3457 (GCVE-0-2026-3457)
Vulnerability from cvelistv5 – Published: 2026-03-27 09:05 – Updated: 2026-09-03 15:44
VLAI
EPSS
VEX
Title
Stored XSS vulnerability in Sentinel ACC
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Thales Sentinel LDK Runtime on Windows allows Stored XSS.
This issue affects Sentinel LDK Runtime: before 10.22.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-27 13:06 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://supportportal.thalesgroup.com/csm?id=kb_a… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thalesgroup | Sentinel LDK Runtime |
Affected:
0 , < 10.22
(custom)
cpe:2.3:a:thalesgroup:sentinel_ldk_runtime:*:*:windows:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3457",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T13:06:20.772171Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T13:45:21.259Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Sentinel LDK Runtime",
"vendor": "Thalesgroup",
"versions": [
{
"lessThan": "10.22",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:thalesgroup:sentinel_ldk_runtime:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "10.22",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Josh Dillon"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Thales Sentinel LDK Runtime on Windows allows Stored XSS.\u003cp\u003eThis issue affects Sentinel LDK Runtime: before 10.22.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Thales Sentinel LDK Runtime on Windows allows Stored XSS.\n\nThis issue affects Sentinel LDK Runtime: before 10.22."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:44:12.227Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=5c18186b478aa950128dca72e36d4391\u0026sysparm_article=KB0027106"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade current Sentinel\nLDK Runtime to version 10.22 or higher."
}
],
"value": "Upgrade current Sentinel\nLDK Runtime to version 10.22 or higher."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored XSS vulnerability in Sentinel ACC",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-3457",
"datePublished": "2026-03-27T09:05:48.226Z",
"dateReserved": "2026-03-02T19:33:17.694Z",
"dateUpdated": "2026-09-03T15:44:12.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0872 (GCVE-0-2026-0872)
Vulnerability from cvelistv5 – Published: 2026-02-13 08:53 – Updated: 2026-09-03 15:59
VLAI
EPSS
VEX
Title
Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon
Summary
Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon on Windows allows Signature Spoofing by Improper Validation.
This issue affects SafeNet Agent for Windows Logon: 4.0.0, 4.1.1, 4.1.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-13 12:47 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://thalesdocs.com/sta/agents/wla-windows_log… | mitigation |
| https://supportportal.thalesgroup.com/csm?sys_kb_… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thalesgroup | SafeNet Agent for Windows Logon |
Affected:
4.0.0
Affected: 4.1.1 Affected: 4.1.2 cpe:2.3:a:thalesgroup:safenet_agent_for_windows_logon:4.0.0:*:windows:*:*:*:*:* cpe:2.3:a:thalesgroup:safenet_agent_for_windows_logon:4.1.1:*:windows:*:*:*:*:* cpe:2.3:a:thalesgroup:safenet_agent_for_windows_logon:4.1.2:*:windows:*:*:*:*:* |
Date Public
2026-02-08 08:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0872",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-13T12:47:11.793545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-13T12:47:30.747Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SafeNet Agent for Windows Logon",
"vendor": "Thalesgroup",
"versions": [
{
"status": "affected",
"version": "4.0.0"
},
{
"status": "affected",
"version": "4.1.1"
},
{
"status": "affected",
"version": "4.1.2"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:thalesgroup:safenet_agent_for_windows_logon:4.0.0:*:windows:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:thalesgroup:safenet_agent_for_windows_logon:4.1.1:*:windows:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:thalesgroup:safenet_agent_for_windows_logon:4.1.2:*:windows:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Huy Kha, Director of Security Research, and the team at Netwrix"
}
],
"datePublic": "2026-02-08T08:52:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon on Windows allows Signature Spoofing by Improper Validation.\u003cp\u003eThis issue affects SafeNet Agent for Windows Logon: 4.0.0, 4.1.1, 4.1.2.\u003c/p\u003e"
}
],
"value": "Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon on Windows allows Signature Spoofing by Improper Validation.\n\nThis issue affects SafeNet Agent for Windows Logon: 4.0.0, 4.1.1, 4.1.2."
}
],
"impacts": [
{
"capecId": "CAPEC-475",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-475 Signature Spoofing by Improper Validation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.5,
"baseSeverity": "LOW",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:59:17.919Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"mitigation"
],
"url": "https://thalesdocs.com/sta/agents/wla-windows_logon/wla-preinstallation_passwordless/index.html"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://supportportal.thalesgroup.com/csm?sys_kb_id=247fd4a42b4a7290061af3f5f291bff1\u0026id=kb_article_view\u0026sysparm_rank=1\u0026sysparm_tsqueryId=5ecb72c73b927610381ecfaf55e45a0b\u0026sysparm_article=KB0030173"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to version 4.1.3."
}
],
"value": "Upgrade to version 4.1.3."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-0872",
"datePublished": "2026-02-13T08:53:05.621Z",
"dateReserved": "2026-01-13T09:32:05.991Z",
"dateUpdated": "2026-09-03T15:59:17.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-5264 (GCVE-0-2024-5264)
Vulnerability from cvelistv5 – Published: 2024-05-23 08:40 – Updated: 2024-08-01 21:11
VLAI
EPSS
VEX
Title
Network Key Transfer with AES KHT vulnerability in Luna EFT
Summary
Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-12 20:41 UTC
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | Luna EFT |
Affected:
2.1.0
|
|
| thalesgroup | luna_eft |
Affected:
2.1 , ≤ *
(custom)
cpe:2.3:a:thalesgroup:luna_eft:2.1:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:thalesgroup:luna_eft:2.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "luna_eft",
"vendor": "thalesgroup",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "2.1",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T20:41:30.681683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T20:41:33.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:11.016Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=50da3cd9c302c218204e2a6ce00131b9\u0026sysparm_article=KB0028531"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Network Key Transfer with AES KHT"
],
"platforms": [
"Appliance"
],
"product": "Luna EFT",
"vendor": "Thales",
"versions": [
{
"status": "affected",
"version": "2.1.0"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Network Transfer with AES KHT"
}
],
"value": "Network Transfer with AES KHT"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Cory Whitesell, Sr. Security Engineer, Transaction Network Services"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis"
}
],
"value": "Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis"
}
],
"impacts": [
{
"capecId": "CAPEC-20",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-20 Encryption Brute Forcing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-23T08:40:56.239Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=50da3cd9c302c218204e2a6ce00131b9\u0026sysparm_article=KB0028531"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Network Key Transfer with AES KHT vulnerability in Luna EFT",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Disable functionality in the console - see linked bulletin"
}
],
"value": "Disable functionality in the console - see linked bulletin"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2024-5264",
"datePublished": "2024-05-23T08:40:56.239Z",
"dateReserved": "2024-05-23T08:39:05.391Z",
"dateUpdated": "2024-08-01T21:11:11.016Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0197 (GCVE-0-2024-0197)
Vulnerability from cvelistv5 – Published: 2024-02-27 12:48 – Updated: 2024-08-09 15:26
VLAI
EPSS
VEX
Title
Privilege Escalation in Thales SafeNet Sentinel HASP LDK
Summary
A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-01 17:56 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | Sentinel HASP LDK |
Affected:
0 , < 9.16
(9.16)
|
|
| thalesgroup | safenet_sentinel_hasp |
Affected:
0 , < 9.16
(custom)
cpe:2.3:a:thalesgroup:safenet_sentinel_hasp:*:*:*:*:*:*:*:* |
|
| thalesgroup | safenet_sentinel_ldk |
Affected:
0 , ≤ 9.16
(custom)
cpe:2.3:a:thalesgroup:safenet_sentinel_ldk:*:*:*:*:*:*:*:* |
Date Public
2024-02-15 23:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T17:41:16.069Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://supportportal.thalesgroup.com"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:thalesgroup:safenet_sentinel_hasp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "safenet_sentinel_hasp",
"vendor": "thalesgroup",
"versions": [
{
"lessThan": "9.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:thalesgroup:safenet_sentinel_ldk:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "safenet_sentinel_ldk",
"vendor": "thalesgroup",
"versions": [
{
"lessThanOrEqual": "9.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-01T17:56:38.989974Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-09T15:26:44.274Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Sentinel HASP LDK",
"vendor": "Thales",
"versions": [
{
"lessThan": "9.16",
"status": "affected",
"version": "0",
"versionType": "9.16"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Julian Horoszkiewicz (Eviden Red Team)"
}
],
"datePublic": "2024-02-15T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.\n\n"
}
],
"value": "A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-27T12:48:13.263Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"url": "https://supportportal.thalesgroup.com"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Thales Sentinel LDK version 9.16.\u003cbr\u003e"
}
],
"value": "Upgrade to Thales Sentinel LDK version 9.16.\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Privilege Escalation in Thales SafeNet Sentinel HASP LDK",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2024-0197",
"datePublished": "2024-02-27T12:48:13.263Z",
"dateReserved": "2024-01-02T15:23:33.572Z",
"dateUpdated": "2024-08-09T15:26:44.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-7016 (GCVE-0-2023-7016)
Vulnerability from cvelistv5 – Published: 2024-02-27 10:45 – Updated: 2024-08-15 18:53
VLAI
EPSS
VEX
Title
Privilege Escalation in SafeNet Authentication Client
Summary
A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-27 15:17 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | SafeNet Authentication Client |
Affected:
0 , < 10.8
(patch 10)
|
|
| thalesgroup | safenet_authentication_client |
Affected:
0 , < 10.8
(custom)
cpe:2.3:a:thalesgroup:safenet_authentication_client:*:*:*:*:*:*:*:* |
Date Public
2024-02-18 23:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:50:07.630Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://supportportal.thalesgroup.com"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:thalesgroup:safenet_authentication_client:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "safenet_authentication_client",
"vendor": "thalesgroup",
"versions": [
{
"lessThan": "10.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-7016",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-27T15:17:31.490247Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T18:53:46.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SafeNet Authentication Client",
"vendor": "Thales",
"versions": [
{
"lessThan": "10.8",
"status": "affected",
"version": "0",
"versionType": "patch 10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Kravets Vasiliy, xi-tauw@xi-tauw.info"
}
],
"datePublic": "2024-02-18T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access."
}
],
"value": "A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-27T10:45:28.333Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"url": "https://supportportal.thalesgroup.com"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to the current SafeNet Authentication Client 10.8 R10 (GA).\u003cbr\u003e"
}
],
"value": "Upgrade to the current SafeNet Authentication Client 10.8 R10 (GA).\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Privilege Escalation in SafeNet Authentication Client ",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2023-7016",
"datePublished": "2024-02-27T10:45:28.333Z",
"dateReserved": "2023-12-20T15:48:00.568Z",
"dateUpdated": "2024-08-15T18:53:46.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5993 (GCVE-0-2023-5993)
Vulnerability from cvelistv5 – Published: 2024-02-27 10:42 – Updated: 2024-08-08 19:28
VLAI
EPSS
VEX
Title
Privilege Escalation in SafeNet Authentication Client Installer
Summary
A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-27 15:39 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | SafeNet Authentication Client |
Affected:
0 , < 10.8
(patch 10)
|
|
| thalesgroup | safenet_authentication_client |
Affected:
0 , < 10.8
(custom)
cpe:2.3:a:thalesgroup:safenet_authentication_client:*:*:*:*:*:*:*:* |
Date Public
2024-02-18 23:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:14:25.122Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://supportportal.thalesgroup.com"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:thalesgroup:safenet_authentication_client:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "safenet_authentication_client",
"vendor": "thalesgroup",
"versions": [
{
"lessThan": "10.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5993",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-27T15:39:53.382676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T19:28:36.205Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SafeNet Authentication Client",
"vendor": "Thales",
"versions": [
{
"lessThan": "10.8",
"status": "affected",
"version": "0",
"versionType": "patch 10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Kravets Vasiliy, xi-tauw@xi-tauw.info"
}
],
"datePublic": "2024-02-18T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access."
}
],
"value": "A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-27T10:42:08.287Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"url": "https://supportportal.thalesgroup.com"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to the current SafeNet Authentication Client 10.8 R10 (GA)."
}
],
"value": "Upgrade to the current SafeNet Authentication Client 10.8 R10 (GA)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Privilege Escalation in SafeNet Authentication Client Installer",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2023-5993",
"datePublished": "2024-02-27T10:42:08.287Z",
"dateReserved": "2023-11-07T16:29:48.850Z",
"dateUpdated": "2024-08-08T19:28:36.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-2737 (GCVE-0-2023-2737)
Vulnerability from cvelistv5 – Published: 2023-08-16 15:45 – Updated: 2024-10-01 18:19
VLAI
EPSS
VEX
Title
Improper securing of log directory may allow a denial of service
Summary
Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-01 18:13 UTC
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | SafeNet Authtentication Service Agent |
Affected:
SafeNet Authentication Service Agent , < 3.6.1
(3.6.0)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:33:05.388Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=08f460ba47bba550c0e42e61e36d432f\u0026sysparm_article=KB0027485"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-2737",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-01T18:13:42.811602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-01T18:19:57.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SafeNet Authtentication Service Agent",
"vendor": "Thales",
"versions": [
{
"lessThan": "3.6.1",
"status": "affected",
"version": "SafeNet Authentication Service Agent ",
"versionType": "3.6.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Florian Hansemann, https://hansesecure.de"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper log permissions in SafeNet Authentication Service\u0026nbsp;Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation.\u003cbr\u003e"
}
],
"value": "Improper log permissions in SafeNet Authentication Service\u00a0Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation.\n"
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-16T15:45:29.540Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=08f460ba47bba550c0e42e61e36d432f\u0026sysparm_article=KB0027485"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper securing of log directory may allow a denial of service",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2023-2737",
"datePublished": "2023-08-16T15:45:29.540Z",
"dateReserved": "2023-05-16T13:48:23.279Z",
"dateUpdated": "2024-10-01T18:19:57.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1293 (GCVE-0-2022-1293)
Vulnerability from cvelistv5 – Published: 2022-08-02 15:24 – Updated: 2024-09-16 23:46
VLAI
EPSS
VEX
Title
XSS vulnerability in Citadel
Summary
The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.
Severity
5.7 (Medium)
CWE
- CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ercom.com/security-updates | x_refsource_MISC |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | Citadel Web Client |
Affected:
7.1.1 , < 7.1.2
(custom)
|
|
| Thales | Citadel Macosx Desktop Client |
Affected:
7.1.1 , < 7.1.2
(custom)
|
|
| Thales | Citadel Windows Desktop Client |
Affected:
7.1.1 , < 7.1.2
(custom)
|
Date Public
2022-08-01 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:55:24.610Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.ercom.com/security-updates"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Web Client"
],
"product": "Citadel Web Client",
"vendor": "Thales",
"versions": [
{
"lessThan": "7.1.2",
"status": "affected",
"version": "7.1.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"Macosx"
],
"product": "Citadel Macosx Desktop Client",
"vendor": "Thales",
"versions": [
{
"lessThan": "7.1.2",
"status": "affected",
"version": "7.1.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"Windows"
],
"product": "Citadel Windows Desktop Client",
"vendor": "Thales",
"versions": [
{
"lessThan": "7.1.2",
"status": "affected",
"version": "7.1.1",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-08-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-09T17:56:59.000Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ercom.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 7.1.2"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "XSS vulnerability in Citadel",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@thalesgroup.com",
"DATE_PUBLIC": "2022-08-01T00:00:00.000Z",
"ID": "CVE-2022-1293",
"STATE": "PUBLIC",
"TITLE": "XSS vulnerability in Citadel"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Citadel Web Client",
"version": {
"version_data": [
{
"platform": "Web Client",
"version_affected": "\u003c",
"version_name": "7.1.1",
"version_value": "7.1.2"
}
]
}
},
{
"product_name": "Citadel Macosx Desktop Client",
"version": {
"version_data": [
{
"platform": "Macosx",
"version_affected": "\u003c",
"version_name": "7.1.1",
"version_value": "7.1.2"
}
]
}
},
{
"product_name": "Citadel Windows Desktop Client",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "\u003c",
"version_name": "7.1.1",
"version_value": "7.1.2"
}
]
}
}
]
},
"vendor_name": "Thales"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ercom.com/security-updates",
"refsource": "MISC",
"url": "https://www.ercom.com/security-updates"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 7.1.2"
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2022-1293",
"datePublished": "2022-08-02T15:24:27.869Z",
"dateReserved": "2022-04-11T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:46:35.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42056 (GCVE-0-2021-42056)
Vulnerability from cvelistv5 – Published: 2022-06-24 16:14 – Updated: 2024-08-04 03:22
VLAI
EPSS
VEX
Summary
Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:22:25.925Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-24T16:14:23.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-42056",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056",
"refsource": "MISC",
"url": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-42056",
"datePublished": "2022-06-24T16:14:23.000Z",
"dateReserved": "2021-10-07T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:22:25.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42811 (GCVE-0-2021-42811)
Vulnerability from cvelistv5 – Published: 2022-06-10 10:20 – Updated: 2024-09-16 21:08
VLAI
EPSS
VEX
Title
Vulnerability in SafeNet KeySecure
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://supportportal.thalesgroup.com/csm?id=kb_a… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales DIS | SafeNet KeySecure |
Affected:
8.12.4 , ≤ 8.12.4
(custom)
|
Date Public
2022-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:38:50.209Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=9278cada973f45509fd638d3f153afff\u0026sysparm_article=KB0025953"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SafeNet KeySecure",
"vendor": "Thales DIS",
"versions": [
{
"lessThanOrEqual": "8.12.4",
"status": "affected",
"version": "8.12.4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "We thank the Dell Security Assurance Team for reporting these vulnerabilities."
}
],
"datePublic": "2022-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-10T10:20:32.000Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=9278cada973f45509fd638d3f153afff\u0026sysparm_article=KB0025953"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 8.12.5 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Vulnerability in SafeNet KeySecure",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@thalesgroup.com",
"DATE_PUBLIC": "2022-06-09T00:00:00.000Z",
"ID": "CVE-2021-42811",
"STATE": "PUBLIC",
"TITLE": "Vulnerability in SafeNet KeySecure"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SafeNet KeySecure",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "8.12.4",
"version_value": "8.12.4"
}
]
}
}
]
},
"vendor_name": "Thales DIS"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "We thank the Dell Security Assurance Team for reporting these vulnerabilities."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=9278cada973f45509fd638d3f153afff\u0026sysparm_article=KB0025953",
"refsource": "MISC",
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=9278cada973f45509fd638d3f153afff\u0026sysparm_article=KB0025953"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 8.12.5 or later."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2021-42811",
"datePublished": "2022-06-10T10:20:32.246Z",
"dateReserved": "2021-10-21T00:00:00.000Z",
"dateUpdated": "2024-09-16T21:08:15.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42810 (GCVE-0-2021-42810)
Vulnerability from cvelistv5 – Published: 2022-01-19 17:12 – Updated: 2024-09-17 01:41
VLAI
EPSS
VEX
Title
Safenet Authentication Service Remote Desktop Gateway prior to 2.0.3 may allow privilege escilation to authenticated users
Summary
A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed.
Severity
7.8 (High)
CWE
- CWE-336 - Same Seed in Pseudo-Random Number Generator (PRNG)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cpl.thalesgroup.com/support/security-updates | x_refsource_MISC |
| https://github.com/mandiant/Vulnerability-Disclos… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | SafeNet Authentication Service |
Affected:
Remote Desktop Gateway , < 2.0.3
(custom)
|
Date Public
2022-01-19 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:38:50.228Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cpl.thalesgroup.com/support/security-updates"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0002/MNDT-2022-0002.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SafeNet Authentication Service",
"vendor": "Thales",
"versions": [
{
"lessThan": "2.0.3",
"status": "affected",
"version": "Remote Desktop Gateway",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ronnie Salomonsen, Mandiant"
}
],
"datePublic": "2022-01-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-336",
"description": "CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-24T18:48:10.000Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cpl.thalesgroup.com/support/security-updates"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0002/MNDT-2022-0002.md"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Safenet Authentication Service Remote Desktop Gateway to version 2.0.3 or newer."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Safenet Authentication Service Remote Desktop Gateway prior to 2.0.3 may allow privilege escilation to authenticated users",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@thalesgroup.com",
"DATE_PUBLIC": "2022-01-19T00:00:00.000Z",
"ID": "CVE-2021-42810",
"STATE": "PUBLIC",
"TITLE": "Safenet Authentication Service Remote Desktop Gateway prior to 2.0.3 may allow privilege escilation to authenticated users"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SafeNet Authentication Service",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Remote Desktop Gateway",
"version_value": "2.0.3"
}
]
}
}
]
},
"vendor_name": "Thales"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Ronnie Salomonsen, Mandiant"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cpl.thalesgroup.com/support/security-updates",
"refsource": "MISC",
"url": "https://cpl.thalesgroup.com/support/security-updates"
},
{
"name": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0002/MNDT-2022-0002.md",
"refsource": "MISC",
"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0002/MNDT-2022-0002.md"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Safenet Authentication Service Remote Desktop Gateway to version 2.0.3 or newer."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2021-42810",
"datePublished": "2022-01-19T17:12:02.882Z",
"dateReserved": "2021-10-21T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:41:35.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42138 (GCVE-0-2021-42138)
Vulnerability from cvelistv5 – Published: 2021-12-20 20:19 – Updated: 2024-08-04 03:30
VLAI
EPSS
VEX
Summary
A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine.
Severity
7.2 (High)
CWE
- https://cwe.mitre.org/data/definitions/336.html
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://supportportal.gemalto.com/csm?sys_kb_id=a… | x_refsource_MISC |
| https://supportportal.gemalto.com/csm?sys_kb_id=e… | x_refsource_MISC |
| https://cpl.thalesgroup.com/support/security-updates | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales CPL | Safenet Authentication Service |
Affected:
Windows Logon Agent , < 3.4.4
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:30:37.956Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://supportportal.gemalto.com/csm?sys_kb_id=a52bd13adbff7010f0e322080596194a\u0026id=kb_article_view\u0026sysparm_rank=1\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://supportportal.gemalto.com/csm?sys_kb_id=e8397662dbb7fc10520c4705059619eb\u0026id=kb_article_view\u0026sysparm_rank=2\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cpl.thalesgroup.com/support/security-updates"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Safenet Authentication Service",
"vendor": "Thales CPL",
"versions": [
{
"lessThan": "3.4.4",
"status": "affected",
"version": "Windows Logon Agent",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "compass-security"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "https://cwe.mitre.org/data/definitions/336.html",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-20T20:19:10.000Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://supportportal.gemalto.com/csm?sys_kb_id=a52bd13adbff7010f0e322080596194a\u0026id=kb_article_view\u0026sysparm_rank=1\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://supportportal.gemalto.com/csm?sys_kb_id=e8397662dbb7fc10520c4705059619eb\u0026id=kb_article_view\u0026sysparm_rank=2\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cpl.thalesgroup.com/support/security-updates"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@thalesgroup.com",
"ID": "CVE-2021-42138",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Safenet Authentication Service",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "Windows Logon Agent",
"version_value": "3.4.4"
}
]
}
}
]
},
"vendor_name": "Thales CPL"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "compass-security"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all the users on that machine."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "https://cwe.mitre.org/data/definitions/336.html"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://supportportal.gemalto.com/csm?sys_kb_id=a52bd13adbff7010f0e322080596194a\u0026id=kb_article_view\u0026sysparm_rank=1\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955",
"refsource": "MISC",
"url": "https://supportportal.gemalto.com/csm?sys_kb_id=a52bd13adbff7010f0e322080596194a\u0026id=kb_article_view\u0026sysparm_rank=1\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955"
},
{
"name": "https://supportportal.gemalto.com/csm?sys_kb_id=e8397662dbb7fc10520c4705059619eb\u0026id=kb_article_view\u0026sysparm_rank=2\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955",
"refsource": "MISC",
"url": "https://supportportal.gemalto.com/csm?sys_kb_id=e8397662dbb7fc10520c4705059619eb\u0026id=kb_article_view\u0026sysparm_rank=2\u0026sysparm_tsqueryId=b3bdd932db33b010f0e3220805961955"
},
{
"name": "https://cpl.thalesgroup.com/support/security-updates",
"refsource": "MISC",
"url": "https://cpl.thalesgroup.com/support/security-updates"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2021-42138",
"datePublished": "2021-12-20T20:19:10.000Z",
"dateReserved": "2021-10-11T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:30:37.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42808 (GCVE-0-2021-42808)
Vulnerability from cvelistv5 – Published: 2021-12-20 20:19 – Updated: 2024-08-04 03:38
VLAI
EPSS
VEX
Title
The Sentinel Protection Installer 7.7.0 creates files and directory with all privileges granting any user full permissions.
Summary
Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges.
Severity
6.5 (Medium)
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cpl.thalesgroup.com/fr/software-monetizat… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thales | Sentinel Protection Installer |
Affected:
7.7.0 , ≤ 7.7.0
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:38:50.145Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cpl.thalesgroup.com/fr/software-monetization/security-updates"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows"
],
"product": "Sentinel Protection Installer",
"vendor": "Thales",
"versions": [
{
"lessThanOrEqual": "7.7.0",
"status": "affected",
"version": "7.7.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Intel Corp"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-20T20:19:10.000Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cpl.thalesgroup.com/fr/software-monetization/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Sentinel Protection Installer to version 7.7.1 or newer."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "The Sentinel Protection Installer 7.7.0 creates files and directory with all privileges granting any user full permissions.",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@thalesgroup.com",
"ID": "CVE-2021-42808",
"STATE": "PUBLIC",
"TITLE": "The Sentinel Protection Installer 7.7.0 creates files and directory with all privileges granting any user full permissions."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Sentinel Protection Installer",
"version": {
"version_data": [
{
"platform": "Windows",
"version_affected": "\u003c=",
"version_name": "7.7.0",
"version_value": "7.7.0"
}
]
}
}
]
},
"vendor_name": "Thales"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Intel Corp"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284 Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cpl.thalesgroup.com/fr/software-monetization/security-updates",
"refsource": "MISC",
"url": "https://cpl.thalesgroup.com/fr/software-monetization/security-updates"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Sentinel Protection Installer to version 7.7.1 or newer."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2021-42808",
"datePublished": "2021-12-20T20:19:10.000Z",
"dateReserved": "2021-10-21T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:38:50.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-202201-1941
Vulnerability from variot - Updated: 2023-12-18 12:15A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed. SafeNet Agent for Remote Desktop Gateway for, PRNG A vulnerability exists related to improper use of seeds in .Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Thales Group Thales Sentinel Protection Installer is an integrated installer of the French company Thales Group
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202201-1941",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "safenet authentication service remote desktop gateway",
"scope": "lte",
"trust": 1.0,
"vendor": "thalesgroup",
"version": "2.0.3"
},
{
"model": "safenet agent for remote desktop gateway",
"scope": null,
"trust": 0.8,
"vendor": "thales group",
"version": null
},
{
"model": "safenet agent for remote desktop gateway",
"scope": "eq",
"trust": 0.8,
"vendor": "thales group",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-003587"
},
{
"db": "NVD",
"id": "CVE-2021-42810"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:thalesgroup:safenet_authentication_service_remote_desktop_gateway:*:*:*:*:*:windows:*:*",
"cpe_name": [],
"versionEndIncluding": "2.0.3",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-42810"
}
]
},
"cve": "CVE-2021-42810",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 7.2,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2021-42810",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-403863",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2022-003587",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2021-42810",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "psirt@thalesgroup.com",
"id": "CVE-2021-42810",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202201-1755",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-403863",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-403863"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-003587"
},
{
"db": "NVD",
"id": "CVE-2021-42810"
},
{
"db": "NVD",
"id": "CVE-2021-42810"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-1755"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a system where the agent is installed. SafeNet Agent for Remote Desktop Gateway for, PRNG A vulnerability exists related to improper use of seeds in .Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Thales Group Thales Sentinel Protection Installer is an integrated installer of the French company Thales Group",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-42810"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-003587"
},
{
"db": "VULHUB",
"id": "VHN-403863"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-42810",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2022-003587",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202201-1755",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-403863",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-403863"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-003587"
},
{
"db": "NVD",
"id": "CVE-2021-42810"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-1755"
}
]
},
"id": "VAR-202201-1941",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-403863"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:15:58.929000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security\u00a0Updates",
"trust": 0.8,
"url": "https://cpl.thalesgroup.com/support/security-updates"
},
{
"title": "Thales Sentinel Protection Installer Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=179556"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-003587"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-1755"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-335",
"trust": 1.1
},
{
"problemtype": "PRNG Improper use of seeds in (CWE-335) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-403863"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-003587"
},
{
"db": "NVD",
"id": "CVE-2021-42810"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://github.com/mandiant/vulnerability-disclosures/blob/master/2022/mndt-2022-0002/mndt-2022-0002.md"
},
{
"trust": 1.7,
"url": "https://cpl.thalesgroup.com/support/security-updates"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-42810"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-403863"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-003587"
},
{
"db": "NVD",
"id": "CVE-2021-42810"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-1755"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-403863"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-003587"
},
{
"db": "NVD",
"id": "CVE-2021-42810"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-1755"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-01-19T00:00:00",
"db": "VULHUB",
"id": "VHN-403863"
},
{
"date": "2023-02-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-003587"
},
{
"date": "2022-01-19T18:15:07.880000",
"db": "NVD",
"id": "CVE-2021-42810"
},
{
"date": "2022-01-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202201-1755"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-01-25T00:00:00",
"db": "VULHUB",
"id": "VHN-403863"
},
{
"date": "2023-02-27T01:39:00",
"db": "JVNDB",
"id": "JVNDB-2022-003587"
},
{
"date": "2022-01-25T21:08:22.510000",
"db": "NVD",
"id": "CVE-2021-42810"
},
{
"date": "2022-02-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202201-1755"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202201-1755"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SafeNet\u00a0Agent\u00a0for\u00a0Remote\u00a0Desktop\u00a0Gateway\u00a0 In \u00a0PRNG\u00a0 Improper Use of Seeds Vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-003587"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202201-1755"
}
],
"trust": 0.6
}
}