Key Management Errors

Every one of the 40 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of…CVE-2015-0936Ceragon · 78% likely
2. Client DoS due to large DH parameterCVE-2018-0732OpenSSL · 47% likely

   OpenSSL1 bounty report

3. The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execute arbitrary code by leveraging use of a short GPG key id fr…CVE-2015-0839Hp · 6.3% likely

   HP

4. A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execut…CVE-2018-0124Cisco · 5.1% likely

   Cisco

5. Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.CVE-2016-9963Exim · 3.1% likely

   Exim

6. The OpenSSL address implementation in Socat 1.7.3.0 and 2.0.0-b8 does not use a prime number for the DH, which makes it easier for remote attackers to obtain the shared secret.CVE-2016-2217Dest-Unreach · 2.5% likely

   Dest-Unreach

7. A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.CVE-2019-9894Putty · 2.4% likely

   Putty

8. An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The "getprivkeybyid" API call is used to download a PGP Private Key for a specific user after providing authentica…CVE-2015-8542Open-Xchange · 2.2% likely

   Open-Xchange

9. In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal detail…CVE-2016-1000346Bouncycastle · 2.1% likely

   Bouncycastle

10. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occ…CVE-2018-9234Gnupg · 2.0% likely

    Gnupg

11. D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the wireless key.CVE-2015-0153Dlink · 1.9% likely

    D-Link

12. Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.CVE-2013-2233Redhat · 1.9% likely

    Red Hat

13. The pstm_reverse function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid memory read and crash) via a (1) zero value or (2) the key's modu…CVE-2016-6886Matrixssl · 1.7% likely

    Matrixssl

14. A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation may be able to derive information about…CVE-2018-20187Botan Project · 1.5% likely

    Botan Project

15. NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior to R28.3) where the Secure Shell (SSH) keys provided in the…CVE-2019-5672NVIDIA · 1.4% likely

    NVIDIA

16. Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or…CVE-2019-9150Mailvelope · 1.4% likely
17. Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.CVE-2015-7503Zend · 1.4% likely

    Zend

18. Cisco Adaptive Security Appliance IPsec VPN Denial of Service VulnerabilityCVE-2018-15397Cisco · 1.2% likely

    Cisco

19. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD…CVE-2016-10467Qualcomm, Inc. · 1.2% likely

    Qualcomm, Inc.

20. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9…CVE-2016-10421Qualcomm, Inc. · 1.2% likely

    Qualcomm, Inc.

21. Juju Joyent provider uploads user's private ssh key by defaultCVE-2015-1316Ubuntu · CVSS 6.4 · 1.2% likely

    Ubuntu

22. An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13…CVE-2018-7559Opcfoundation · 1.1% likely

    Opcfoundation

23. Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.CVE-2021-26322AMD · 1.0% likely

    AMD

24. In macOS High Sierra before 10.13.2, a logic issue existed in APFS when deleting keys during hibernation. This was addressed with improved state management.CVE-2017-13887Apple · 0.8% likely

    Apple

25. Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key.CVE-2015-4166Cloudera · 0.7% likely

    Cloudera

26. The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a call with more than one Key_Usage set…CVE-2016-6879Botan Project · 0.7% likely

    Botan Project

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.