370 matches found
IBM Domino SSLv3 Padding Oracle On Downgraded Legacy Encryption Vulnerability (POODLE)
The version of IBM Domino formerly Lotus Domino installed on the remote host is affected by a man-in-the-middle MitM information disclosure vulnerability, known as POODLE, due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining...
Uber: CBC "cut and paste" attack may cause Open Redirect(even XSS)
Hello, Uber Security Team I found an vulnerability in Uber URL redirect page. Vulnerability In page...
Apache Traffic Server 5.1.x < 5.1.1 Multiple Vulnerabilities (POODLE)
Binary data 9081.prm...
Debian DLA-400-1 : pound security update (BEAST) (POODLE)
This update fixes certain known vulnerabilities in pound in squeeze-lts by backporting the version in wheezy. CVE-2009-3555 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and...
SUSE SLED11 / SLES11 Security Update : gnutls (SUSE-SU-2016:0077-1)
This update for gnutls fixes the following security issues : - CVE-2015-8313: First byte of the padding in CBC mode is not checked bsc957568 - CVE-2015-2806: Two-byte stack overflow in asn1derdecoding bsc924828 Note that Tenable Network Security has extracted the preceding description block...
Xerox WorkCentre 3550 OpenSSL Multiple Vulnerabilities (XRX15AJ) (FREAK) (POODLE)
According to its model number and software version, the remote Xerox WorkCentre 3550 device is affected by multiple OpenSSL vulnerabilities : - A man-in-the-middle MitM information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles padding bytes when decrypting...
[SECURITY] [DSA 3408-1] gnutls26 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3408-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 01, 2015 https://www.debian.org/security/faq -...
USN-2821-1: GnuTLS vulnerability
It was discovered that GnuTLS incorrectly validated the first byte of padding in CBC modes. A remote attacker could possibly use this issue to perform a padding oracle attack...
USN-2821-1 gnutls26 vulnerability
It was discovered that GnuTLS incorrectly validated the first byte of padding in CBC modes. A remote attacker could possibly use this issue to perform a padding oracle attack...
Apple Xcode < 7.0 (Mac OS X) (POODLE)
The version of Apple Xcode installed on the remote Mac OS X host is prior to 7.0. It is, therefore, affected by the multiple vulnerabilities : - A memory leak issue exists in file d1srtp.c related to the DTLS SRTP extension handling and specially crafted handshake messages. An attacker can exploi...
IBM DB2 10.5 < Fix Pack 6 Multiple Vulnerabilities (Bar Mitzvah)
According to its version, the installation of IBM DB2 10.5 running on the remote host is prior to Fix Pack 6. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the IBM Global Security Kit GSKit when handling RSA temporary keys in a non-export RSA key exchange...
Amazon Linux: Security Advisory (ALAS-2013-171)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Linux: Security Advisory (ALAS-2012-85)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Linux: Security Advisory (ALAS-2013-172)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
This POODLE Bites: Exploiting The SSL 3.0 Fallback
Introduction SSL 3.0 RFC6101 is an obsolete and insecure protocol. While for most practical purposes it has been replaced by its successors TLS 1.0 RFC2246, TLS 1.1 RFC4346, and TLS 1.2 RFC5246, many TLS implementations remain backwardscompatible with SSL 3.0 to interoperate with legacy systems ...
bouncycastle: TLS CBC padding timing attack
It was discovered that bouncycastle leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle...
Updated kdebase4-runtime packages fix CVE-2013-7252 and several bugs
Updated kdebase4-runtime packages fix security vulnerability: kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack CVE-2013-7252. This...
Important: Red Hat Security Advisory: java-1.6.0-openjdk security update
Updated java-1.6.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...
Oracle Solaris Third-Party Patch Update : fetchmail (multiple_vulnerabilities_in_fetchmail) (BEAST)
The remote Solaris system is missing necessary patches to address security updates : - The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained...
CVE-2013-7252
kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack...