Security Bulletin: Vulnerability in SSLv3 enabled in IBM Host On-Demand affects Rational Functional Tester (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Rational Host On-Demand terminal that is bundled with Rational Functional Tester for terminal emulation. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime Technology Edition affect Rational Functional Tester (CVE-2014-3065, CVE-2014-3566, CVE-2014-6511)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 and IBM Runtime Environment Java Technology Edition, Version 7 that is used by IBM Rational Functional Tester. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3...

CVE-2018-1545

IBM Tivoli Storage Manager IBM Spectrum Protect 7.1 and 8.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 142649...

CVE-2018-1785

CVE-2018-1785 affects IBM Spectrum Protect (formerly Tivoli Storage Manager) in both 7.1 and 8.1 lines for IBM Spectrum Protect Server, Client, and related Virtual Environments components. The vulnerability stems from the use of weaker cryptographic algorithms (notably 3DES) that can permit decry...

Path is DEAD between Branch SDWAN devices

Virtual Path is showing DEAD between the Branch SDWAN devices after adding a device as Secondary MCN and pushed the configuration. You will see the following highlighted message getting incremented in SDWANDiagnostic logs : Command: dropcounts Index Count File Name Function Name Line Reason text...

DEBIAN-CVE-2018-16420

Several buffer overflows when handling responses from an ePass 2003 Card in decryptresponse in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service application crash or possibly have unspecified other impa...

CVE-2018-16420

Several buffer overflows when handling responses from an ePass 2003 Card in decryptresponse in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service application crash or possibly have unspecified other impa...

UBUNTU-CVE-2018-16420

Several buffer overflows when handling responses from an ePass 2003 Card in decryptresponse in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service application crash or possibly have unspecified other impa...

OpenSC Buffer Overflow Vulnerability (CNVD-2019-28623)

OpenSC is an open source smart card tool and middleware. A buffer overflow vulnerability exists in the 'decryptresponse' function of the libopensc/card-epass2003.c file in versions of OpenSC prior to 0.19.0-rc1. An attacker could exploit this vulnerability to cause a denial of service application...

PT-2018-13556

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.19.0-rc1 Description The issue is related to several buffer overflows that occur when handling responses from an ePass 2003 Card in the decrypt response function in libopensc/card-epass2003.c. This could be exploited...

CVE-2018-16420

Several buffer overflows when handling responses from an ePass 2003 Card in decryptresponse in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service application crash or possibly have unspecified other impa...

X (Formerly Twitter): HTTPS is not validating TLS mac codes

https://twitterflightschool.com is prone to POODLE and also a stronger variant of POODLE which allows a MITM attacker to actively decrypt bytes from an HTTPS request. This attack is possible because the device terminating this TLS connection responds differently to a bad record mac when the last...

CVE-2018-15576

An issue was discovered in EasyLogin Pro through 1.3.0. Encryptor.php contains an unserialize call that can be exploited for remote code execution in the decrypt function, if the attacker knows the key...

CVE-2018-15576

An issue was discovered in EasyLogin Pro through 1.3.0. Encryptor.php contains an unserialize call that can be exploited for remote code execution in the decrypt function, if the attacker knows the key...

PT-2018-13100

Name of the Vulnerable Software and Affected Versions EasyLogin Pro versions prior to 1.3.1 Description An issue was discovered in EasyLogin Pro where the Encryptor.php file contains an unserialize call that can be exploited for remote code execution in the decrypt function. This can happen if th...

CVE-2018-15576: Deserialization of Untrusted Data

An issue was discovered in EasyLogin Pro through 1.3.0. Encryptor.php contains an unserialize call that can be exploited for remote code execution in the decrypt function, if the attacker knows the key...

Design/Logic Flaw

Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a Bleichenbacher Oracle vulnerability in the IPSEC IKEv1 implementations. Remote attackers can decrypt IPSEC tunnel ciphertext data by leveraging a Bleichenbache...

CVE-2017-17305

Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a Bleichenbacher Oracle vulnerability in the IPSEC IKEv1 implementations. Remote attackers can decrypt IPSEC tunnel ciphertext data by leveraging a Bleichenbache...

CVE-2017-17305

Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a Bleichenbacher Oracle vulnerability in the IPSEC IKEv1 implementations. Remote attackers can decrypt IPSEC tunnel ciphertext data by leveraging a Bleichenbache...

CVE-2017-17305: Undefined Security Weakness

Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a Bleichenbacher Oracle vulnerability in the IPSEC IKEv1 implementations. Remote attackers can decrypt IPSEC tunnel ciphertext data by leveraging a Bleichenbache...