1574 matches found
Code injection
IBM Control Center 6.x before 6.0.0.1 iFix06 and Sterling Control Center 5.4.x before 5.4.2.1 iFix09 allow local users to decrypt the master key via unspecified vectors...
OpenSSL 1.0.1 < 1.0.1t / 1.0.2 < 1.0.2h Multiple Vulnerabilities
Binary data 9390.prm...
The vulnerability of the OpenSSL software allows a malicious attacker to compromise the accessibility of protected information.
A memory leak in the tlsdecryptticket function in t1lib.c of OpenSSL allows malicious actors operating remotely to trigger a service failure excessive memory consumption by using a specially crafted session credential, which causes a verification error for integrity checking...
IBM WebSphere MQ for IBM i Password Acquisition Vulnerability
IBM WebSphere MQ is a messaging middleware product. A password acquisition vulnerability exists in the IBM WebSphere MQ mqcertck tool, which can be exploited by a local attacker to decrypt other MQ administrator passwords with administrator privileges...
How to Decrypt TeslaCrypt Ransomware Files Using Master Key
Here’s some rare good news for victims struggling to unlock files encrypted by the TeslaCrypt ransomware. You can now decrypt all files locked by TeslaCrypt without paying a ransom. That means victims no longer need to search endlessly for ways to recover TeslaCrypt-encrypted data. The solution h...
Important: openssl
Issue Overview: A vulnerability was discovered that allows a man-in-the-middle attacker to use a padding oracle attack to decrypt traffic on a connection using an AES CBC cipher with a server supporting AES-NI. CVE-2016-2107, Important It was discovered that the ASN.1 parser can misinterpret a...
SA120 : Truncated Diffie-Hellman Secret Generation in libssh2
SUMMARY Blue Coat products that include affected versions of libssh2 are susceptible to a truncated Diffie-Hellman secret length vulnerability. A remote man-in-the-middle MITM attacker can exploit this vulnerability to intercept SSH connections that originate from Blue Coat products. The MITM...
libssh2 diffie_hellman_sha256 information disclosure vulnerability
libssh2 is a client-side C library that implements the SSH2 protocol. An information disclosure vulnerability exists in libssh2 diffiehellmansha256, which can be exploited by an attacker to decrypt or intercept SSH sessions...
CVE-2016-0787
The diffiehellmansha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."...
How to Decrypt Petya Ransomware for Free
Ransomware has grown rapidly over the past few years and is now one of the most common threats on the Internet. These attacks have become increasingly aggressive, often leaving victims with little choice but to pay a ransom to recover critical and sensitive data. However, victims of Petya...
Security Advisory - OpenSSL DROWN Security Vulnerability
OpenSSL official website released a security advisory about a high risk vulnerability dubbed DROWN CVE-2016-0800 on March 1st, 2016. The vulnerability is: Once SSLv2 is used, an attacker can capture packets or act as a man in the middle MIMT to obtain SSL session keys, decrypt encrypted traffic,...
The vulnerability of the OpenSSL library, which allows a hacker to decrypt data
The vulnerability in the getclientmasterkey function of the s2srvr.c file, within the SSLv2 implementation using the OpenSSL library, is related to the improper operation of the protection mechanism against prediction attacks. This mechanism incorrectly re-saves the key data before exporting the...
Cisco Prime LAN Management Solution Hardcoding Vulnerability
Cisco Prime LAN Management Solution is a LAN-based network management solution from Cisco. A hard-coded vulnerability exists in Cisco Prime LAN Management Solution, which allows a local attacker to decrypt data in the LMS database using a hard-coded key to compromise an affected device...
CVE-2016-0704
An oracle protection mechanism in the getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier fo...
Code injection
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by...
SSL/TLS: Cross-protocol attack on TLS using SSLv2 (DROWN)
A padding oracle flaw was found in the Secure Sockets Layer version 2.0 SSLv2 protocol. An attacker could potentially use this flaw to decrypt RSA-encrypted cipher text from a connection using a newer SSL/TLS protocol version, allowing them to decrypt such connections. This cross-protocol attack ...
DROWN Flaw Opens 33 Percent Of HTTPS Connections To Attack
Researchers revealed a massive transport layer security TLS vulnerability today that leaves millions of Internet users vulnerable to an attack that could expose passwords, credit card numbers and financial data. OpenSSL and others are urging companies to patch their web servers or risk exposure t...
[SECURITY] [DSA 3488-1] libssh security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3488-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 23, 2016 https://www.debian.org/security/faq -...
[SECURITY] [DLA 425-1] libssh security update
Package : libssh Version : 0.4.5-3+squeeze3 CVE ID : CVE-2016-0739 Aris Adamantiadis of the libssh team discovered that libssh, an SSH2 protocol implementation used by many applications, did not generate sufficiently long Diffie-Hellman secrets. This vulnerability could be...
