Design/Logic Flaw

The S/MIME feature in Open Ticket Request System OTRS before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available fo...

Keynect Ecommerce SQL Injection Vulnerability

Exploit for php platform in category web applications ======================================================================================== | Title : SQL Injection Keynect Ecommerce | | Author : Arturo Zamora | | email : email protected | | DAte : 10/03/2011 | | Verified : yes | | Risk : High ...

CVE-2010-3618

PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by concatenating an...

Design/Logic Flaw

PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by concatenating an...

CVE-2010-3618

CVE-2010-3618 affects PGP Desktop versions 10.0.x prior to 10.0.3 SP2 and 10.1.0 prior to 10.1.0 SP1. The vulnerability lies in the Decrypt/Verify File via Right-Click workflow for multi-packet OpenPGP messages, enabling a remote attacker to spoof signed data by appending an unsigned/extra messag...

Microsoft ASP.NET - Auto-Decryptor File Download (MS10-070)

Microsoft ASP.NET - Auto-Decryptor File Download MS10-070 !/usr/bin/ruby -w aspxadchotextattack.rb Copyright c 2010 AmpliaSECURITY. All rights reserved http://www.ampliasecurity.com Agustin Azubel - [email protected] MS10-070 ASPX proof of concept Decrypt data using an auto decryptor...

BlackBerry Desktop Software Security Bypass Vulnerability

BlackBerry Desktop Software is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

BbtsConnectionEdit.exe in Blackboard Transact Suite formerly Blackboard Commerce Suite before 3.6.0.2 relies on field names when determining whether it is appropriate to decrypt a connection.xml field value, which allows local users to discover the database password via a modified connection.xml...

win32/xp sp3 (SPA) URLDownloadToFileA + CreateProcessA + ExitProcess

Exploit for win32 platform in category shellcode ==================================================================== win32/xp sp3 SPA URLDownloadToFileA + CreateProcessA + ExitProcess ==================================================================== !/usr/bin/perl c0d3d by r0i aka d0lc3 Explo...

Default configuration

The default installation of Sourcefire 3D Sensor 1000, 2000, and 9900; and Defense Center 1000; uses the same static, private SSL keys for multiple devices and installations, which allows remote attackers to decrypt SSL traffic via a man-in-the-middle MITM attack...

CVE-2010-2306

The default installation of Sourcefire 3D Sensor 1000, 2000, and 9900; and Defense Center 1000; uses the same static, private SSL keys for multiple devices and installations, which allows remote attackers to decrypt SSL traffic via a man-in-the-middle MITM attack...

CVE-2009-3035

The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials, and stores this key on the Notification Server machine, which allows local users to obtain sensitive information and...

Social worker database+configuration upload scored webshell-vulnerability warning-the black bar safety net

BY:small Wu blog:http://hi. baidu. com/q369568652 Today in the group. A friend lost a station. That is the Universal password to everyone to help look. Sure enough,a universal password to get in. Went in and saw no backup. There is an upload and ewebeditor. ! Thought might win a bit difficult. He...

DEBIAN-CVE-2009-4212

Multiple integer underflows in the 1 AES and 2 RC4 decryption functionality in the crypto library in MIT Kerberos 5 aka krb5 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code by providing ciphertext with a...

CVE-2009-3200

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create an undocumented recovery key and store it in the ENCK variable in flash memory, which allows local users to bypass the passphrase requirement and decrypt the hard drive by reading this variable,...

CVE-2009-1477

The https web interfaces on the ATEN KH1516i IP KVM switch with firmware 1.0.063, the KN9116 IP KVM switch with firmware 1.1.104, and the PN9108 power-control unit have a hardcoded SSL private key, which makes it easier for remote attackers to decrypt https sessions by extracting this key from...

CVE-2009-1477

The https web interfaces on the ATEN KH1516i IP KVM switch with firmware 1.0.063, the KN9116 IP KVM switch with firmware 1.1.104, and the PN9108 power-control unit have a hardcoded SSL private key, which makes it easier for remote attackers to decrypt https sessions by extracting this key from...

SquirrelMail: Multiple cross site scripting issues

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail before 1.4.18 and NaSMail before 1.7 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 certain encrypted strings in e-mail headers, related to contrib/decryptheaders.php; 2 PHPSELF; and 3 the que...

CVE-2009-1374

Pidgin (formerly Gaim) is affected by CVE-2009-1374 due to a buffer overflow in the decrypt_out function when processing QQ packets, which can cause the application to crash (DoS). Several connected advisories note this as part of a set of fixes for Pidgin in 2009 across multiple distributions (e...

pidgin DoS when decrypting qq packets

Buffer overflow in the decryptout function in Pidgin formerly Gaim before 2.5.6 allows remote attackers to cause a denial of service application crash via a QQ packet...