CVE-2006-1115

nCipher HSM before 2.22.6, when generating a Diffie-Hellman public/private key pair without any specified DiscreteLogGroup parameters, chooses random parameters that could allow an attacker to crack the private key in significantly less time than a brute force attack.

• http://secunia.com/advisories/19137Patch, Vendor Advisory
• http://securitytracker.com/id?1015719Patch, Vendor Advisory
• http://www.ncipher.com/resources/95/sa12_insecure_generation_of_diffiehellman_keysPatch, Vendor Advisory
• http://www.securityfocus.com/archive/1/427146/100/0/threaded
• http://www.securityfocus.com/bid/17006Patch
• http://www.vupen.com/english/advisories/2006/0862
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25060
• http://secunia.com/advisories/19137Patch, Vendor Advisory
• http://securitytracker.com/id?1015719Patch, Vendor Advisory
• http://www.ncipher.com/resources/95/sa12_insecure_generation_of_diffiehellman_keysPatch, Vendor Advisory
• http://www.securityfocus.com/archive/1/427146/100/0/threaded
• http://www.securityfocus.com/bid/17006Patch
• http://www.vupen.com/english/advisories/2006/0862
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25060

Published

Mar 9, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-1109SQL injection vulnerability in index.asp in Total Ecommerce …
• CVE-2006-1110Cross-site scripting (XSS) vulnerability in Aztek Forum 4.0 …
• CVE-2006-1111Aztek Forum 4.0 allows remote attackers to obtain sensitive …
• CVE-2006-1112Aztek Forum 4.0 allows remote attackers to obtain sensitive …
• CVE-2006-1113SQL injection vulnerability in podcast.php in Loudblog befor…
• CVE-2006-1114Multiple directory traversal vulnerabilities in Loudblog bef…
• CVE-2006-1116The CBC-MAC integrity functions in the nCipher nCore API bef…
• CVE-2006-1117nCipher firmware before V10, as used by (1) nShield, (2) nFo…
• CVE-2006-1118SQL injection vulnerability in bmail before Aardvark PR9.1 a…
• CVE-2006-1119fantastico in Cpanel does not properly handle when it has in…
• CVE-2006-1120Multiple cross-site scripting (XSS) vulnerabilities in DCP-P…
• CVE-2006-1121Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 a…