Security Bulletin: A vulnerability in the GSKit component of IBM DataPower Gateways (CVE-2016-0201)

Summary IBM DataPower Gateways uses GSKit in certain modules - namely MQ, ISAM/TAM, JMS. A vulnerability has been addressed in the GSKit component of IBM DataPower Gateways. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive...

Security Bulletin: A vulnerability in the GSKit component of IBM MQ Appliance (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of IBM MQ Appliance Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability to obtain...

jsonwebtoken node module bypass authentication vulnerability

The jsonwebtoken node module is a JSON Web Taken JWT implementation for node.js. A security vulnerability exists in the jsonwebtoken node module prior to version 4.2.2, which stems from the program using the same signature to validate two types of tokens. An attacker could use this vulnerability ...

Code injection

Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. The algorithm used to encrypt the password is vulnerable to hash collision attacks...

CVE-2018-7242

Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. The algorithm used to encrypt the password is vulnerable to hash collision attacks...

Hash Collision

Bouncy Castle is vulnerable to hash collision attacks. The library keystore files uses a HMAC hash that is only 16 bits long, allowing a malicious user to retrieve the password used for keystore integrity verification checks. This vulnerability only affects users of the BKS-V1 keystore format,...

Microsoft PowerShell Core Denial of Service Vulnerability - Windows

This host is missing an important security update for PowerShell Core according to Microsoft security update March 2018. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

ASP.NET Core Denial of Service Vulnerability - Windows

ASP.NET Core is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Core: Hash Collision Denial of Service

It was found that string comparisons in .NET Core did not use a secure hashing algorithm. This could allow an attacker to predict string hashes and cause a denial of service by intentionally creating collisions thus forcing long look up times...

.NET Core Denial of Service Vulnerability

A denial of service vulnerability exists in the way that .NET Core handles specially crafted requests, causing a hash collision. To exploit the vulnerability, an attacker could send a small number of specially crafted requests to an .NET Core web application, causing performance to degrade...

CVE-2017-15136

When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previously registered system the previously registered system will lose access to updates including security updates...

Real World Crypto 2018 (RWC 2018) brain dump

The 2018 edition of Real World Crypto RWC was in Zurich you can find the conference full program here.. I live in Switzerland so I was extremely happy about it. RWC is basically the best conference I ever attended and it will probably be so for a while. I almost risked to skip it due to flu but I...

Hash Collision Attack

Apache James Project is vulnerable to collision attack. The application generates a unique index key for every email body using the predictable hashing algorithm MD5, allowing attackers to guess the indexed email's contents and perform an unauthorized access/replacement to the email body...

nodejs: Constant Hashtable Seeds vulnerability

It was found that Node.js was using a non-randomized seed when populating hash tables. An attacker, able to supply a large number of inputs, could send specially crafted entries to the Node.js application, maximizing hash collisions to trigger an excessive amount of CPU usage, resulting in a deni...

Weak Password Hashing Algorithm

WordPress is vulnerable to collision attacks. It uses a weak MD-5 based password hashing algorithm, making it easier for attackers to obtain a valid password hash...

CVE-2015-5224

The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks...

Code injection

The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks...

CVE-2015-5224

The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks...

CVE-2015-5224

The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks...

CVE-2015-5224

CVE-2015-5224 affects util-linux's login-utils mkostemp usage, enabling remote attackers to cause file name collisions and potentially other attacks. Affected component is login-utils in util-linux; root cause is incorrect usage of mkostemp. CVSS indicates high/critical impact vectors (network at...