3 results · Clear filters · Feed
-
Medium 6.5
NeuVector is shipping cryptographic material into its binary
NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data.
-
Medium 5.3
NeuVector process with sensitive arguments lead to leakage
When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector security event log.
-
Medium 5.3
NeuVector has an insecure password storage vulnerable to rainbow attack
NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed).