Scanner for Bleichenbacher Oracle in RSA PKCS #1 v1.5

Some TLS implementations handle errors processing RSA key exchanges and encryption PKCS 1 v1.5 messages in a broken way that leads an adaptive chosen-chiphertext attack. Attackers cannot recover a server's private key, but they can decrypt and sign messages with it. A strong oracle occurs when th...

The vulnerability of Sonatype Nexus Repository Manager, related to the use of cryptographic algorithms containing defects, allows a perpetrator to gain access to authentication data.

The vulnerability of Sonatype Nexus Repository Manager is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to user authentication data and other sensitive information...

Weak DH Key Exchange Supported (PCI DSS)

At least one of the services on the remote host supports a Diffie-Hellman key exchange using a public modulus smaller than 2048 bits. Diffie-Hellman key exchanges with keys smaller than 2048 bits do not meet the PCI definition of strong cryptography as specified by NIST Special Publication 800-57...

SSL/TLS Services Support RC4 (PCI DSS)

At least one of the SSL or TLS services on the remote host supports the use of RC4 for encryption. RC4 does not meet the PCI definition of strong cryptography as defined by NIST Special Publication 800-57 Part 1. The RC4 cipher is flawed in its generation of a pseudo-random stream of bytes so tha...

Telerik UI for ASP.NET AJAX 2012.3.1308 2017.1.118 - Arbitrary File Upload

Telerik UI for ASP.NET AJAX 2012.3.1308 2017.1.118 - Arbitrary File Upload Exploit Title: Telerik UI for ASP.NET AJAX RadAsyncUpload uploader Filename: RAUcrypto.py Github: https://github.com/bao7uo/RAUcrypto Date: 2018-01-23 Exploit Author: Paul Taylor / Foregenix Ltd Website:...

Debian: Security Advisory (DLA-954-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Wallarm Podcast: Security Challenges of 2017 and Predictions for 2018

Right before Christmas, we have invited several security professionals to a roundtable event where we discussed how AI is affecting cybersecurity landscape. While we had them on as panelists, we have asked Richard Seiersen, Bill Chen and Sean Todd to share their views on the biggest security...

OpenJDK: insufficient strength of key agreement (JCE, 8185292)

It was discovered that the key agreement implementations in the JCE component of OpenJDK did not guarantee sufficient strength of used keys to adequately protect generated shared secret. This could make it easier to break data encryption by attacking key agreement rather than the encryption using...

OpenJDK: insufficient strength of key agreement (JCE, 8185292)

It was discovered that the key agreement implementations in the JCE component of OpenJDK did not guarantee sufficient strength of used keys to adequately protect generated shared secret. This could make it easier to break data encryption by attacking key agreement rather than the encryption using...

Insecure Default

github.com/cloudflare/redoctober is vulnerable to insecure defaults. The library uses an insecure Elliptic Curve Diffie-Hellman ECDH cryptography library by default...

Il (triste??) stato della crittografia (applicata) in Italia

Ho appena finito di scrivere a proposito dei miei 3 giorni trascorsi al Real World Crypto 2018 il blog post per chi legge inglese e' qui e mi sono accorto che non c'e' traccia di nessuna Universita' ma anche azienda italiana. Tutto cio' non puo' che rendermi un po' triste. L'Italia aveva una...

Real World Crypto 2018 (RWC 2018) brain dump

The 2018 edition of Real World Crypto RWC was in Zurich you can find the conference full program here.. I live in Switzerland so I was extremely happy about it. RWC is basically the best conference I ever attended and it will probably be so for a while. I almost risked to skip it due to flu but I...

Sitefinity Authentication Bypass Vulnerability (Jan 2018)

Sitefinity allows remote attackers to bypass authentication. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:progress:sitefinity"...

Authentication flaw

Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load balanced sites or gain privileges via vectors related to weak cryptography...

CVE-2017-15883

Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load balanced sites or gain privileges via vectors related to weak cryptography...

CVE-2017-15883

Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load balanced sites or gain privileges via vectors related to weak cryptography...

CVE-2017-15883

CVE-2017-15883 affects Progress Sitefinity across versions 5.1–10.x. The vulnerability allows remote attackers to bypass authentication and potentially gain privileges, resulting in denial of service on load-balanced deployments, with vectors related to weak cryptography. The connected documents ...

CVE-2017-15883

Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load balanced sites or gain privileges via vectors related to weak cryptography...

About the security content of macOS High Sierra 10.13.2 Supplemental Update - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

CVE-2017-1665

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 133559...