Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-31856PUBLISHED: 2022-07-05Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php.
CVE-2022-32310PUBLISHED: 2022-07-05An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/Users.php.
CVE-2022-32311PUBLISHED: 2022-07-05Ingredient Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /isms/admin/stocks/view_stock.php.
CVE-2022-32413PUBLISHED: 2022-07-05An arbitrary file upload vulnerability in Dice v4.2.0 allows attackers to execute arbitrary code via a crafted file.
CVE-2022-34972PUBLISHED: 2022-07-05So Filter Shop v3.x was discovered to contain multiple blind SQL injection vulnerabilities via the att_value_id , manu_value_id , opt_value_id , and subcate_value_id parameters at /index.php?route=extension/module/so_filter_shop_by/filter_data.
User Rank: Author
7/23/2020 | 1:27:51 PM
In the text and linked BlackHat synopsis, the author describes how multiple messages under an AEAD scheme like AES-GCM can be decrypted successfully by multiple keys. I'd say it is unsurprising they decrypt (any key will decrypt the message, just most of the messages would be garbage), but for the security properties of any AEAD construction to hold, the authentication tag should be invalid for the message afterwards. The text reads like the author may have found a way where in specific constructions this is not the case, so I am very excited to read more details about the attack.
The number one reason why I love applied cryptography. You never stop learning :-)
Best, Johannes