EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1477)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The pnrecvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring...

Revive Adserver: Authentication Bypass by abusing Insecure crypto tokens in /lib/OA/Dal/PasswordRecovery.php:

Hi, This is a fun bug I came across while doing a pentest for a client, after going through Revive Advserver's code for a few hours, I found this authentication bypass. This vulnerability seem to affect all versions, including the latest one, I was sent by one of your developers to report it here...

CVE-2019-11840

An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa packages. If more than 256 GiB of keystream i...

Fedora Update for golang-googlecode-go-crypto FEDORA-2019-117e425677

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Shr3dKit

This is an offensive tool for Red Team operations. The tool kit, named Shr3dKit, is a collection of scripts and tools for various stages of a Red Team engagement, including reconnaissance, weaponization, delivery, command and control, lateral movement, establishing a foothold, escalating...

CVE-2019-1706

Summary: CVE-2019-1706 affects Cisco ASAv and Firepower 2100 Series running ASA software. The issue is a logic error in the software cryptography module’s handling of IPsec sessions, allowing an unauthenticated, remote attacker to trigger a device reload and a DoS condition by generating many IPs...

Denial Of Service

Linux kernel is vulnerable to denial of service attacks. A user could exploit this flaw using an AFALG socket with an incompatible algorithm, as demonstrated by mcryptdmd5 causing denial of service conditions. Affected is the file crypto/mcryptd.c...

Denial Of Service (DoS)

ntp is vulnerable to denial of service DoS. The vulnerability exists as it is possible to send a crypto NAK packet from a spoofed source address of an associated peer...

Information Disclosure

kernel-rt is vulnerable to information disclosure. The vulnerability exists as the crypto API does not initialize certain length variables...

Information Disclosure

kernel-rt is vulnerable to information disclosure. The vulnerability exists as the report API in the crypto user configuration API uses an incorrect C library function for copying strings...

Fedora 30 : golang-googlecode-go-crypto (2019-260ca3a81e)

Bump to commit b7391e95e576cacdcdd422573063bc057239113d Security fix for 1691529 and 1691530. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...

CVE-2018-2007

IBM API Connect 2018.1 and 2018.4.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 155078...

Wall Street market exit scam? Admins steal $30 million worth of crypto

By Uzair Amir Wall Street market vendors on the dark web are urging others not to deposit their coins. As you may know, a majority of the dark web users are migrating to the Wall Street marketplace after the closure of the Dream market. Initially, this migration was successful but now a significa...

CVE-2019-9498

The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication,...

CVE-2019-9497

The implementations of EAP-PWD in hostapd EAP Server and wpasupplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not...

CVE-2019-9497

The implementations of EAP-PWD in hostapd EAP Server and wpasupplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not...

Authentication flaw

The implementations of EAP-PWD in hostapd EAP Server and wpasupplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not...

Authentication flaw

The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication,...

Authentication flaw

The implementations of EAP-PWD in wpasupplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection...

CVE-2019-9497 The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit

The implementations of EAP-PWD in hostapd EAP Server and wpasupplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not...