Information Disclosure

ntp is vulnerable to information disclosure. The vulnerability exists as the message digest key is retrievable from the flaw of the message authentication functionality of libntp...

Information Disclosure

Java is vulnerable to information disclosure. When generating DSA signatures, the security component in OpenJDK fails to check the digest algorithm strength. The use of a digest weaker than the key strength could lead to the generation of signatures that are weaker than expected and attackers may...

USN-3937-2: Apache vulnerabilities

USN-3937-1 and USN-3627-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Simon Kappel discovered that the Apache HTTP Server modauthdigest module incorrectly handled threads. A remote attacker with valid...

DEBIAN-CVE-2019-10901

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by handling file digests properly...

EUVD-2019-2623

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by handling file digests properly...

UBUNTU-CVE-2019-10901

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by handling file digests properly...

DEBIAN-CVE-2019-0217

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in modauthdigest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions...

DEBIAN-CVE-2018-10243

htpparseauthorizationdigest in htpparsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header...

CVE-2018-10243

htpparseauthorizationdigest in htpparsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header...

UBUNTU-CVE-2018-10243

htpparseauthorizationdigest in htpparsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header...

CVE-2018-10243

htpparseauthorizationdigest in htpparsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header...

CVE-2018-10243

htpparseauthorizationdigest in htpparsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header...

CVE-2018-10243

htpparseauthorizationdigest in htpparsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header...

CVE-2018-10243

htpparseauthorizationdigest in htpparsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header...

Cisco ASR 900 Cisco IOS XE Input Validation Vulnerability

The Cisco ASR 900 is a 900-series aggregation services router from Cisco, Inc.Cisco IOS XE is an operating system developed for Cisco network devices. An input validation vulnerability exists in Cisco IOS XE in the Cisco ASR 900 Route Switch Processor 3 that stems from the program's failure to...

httpd: Weak Digest auth nonce generation in mod_auth_digest

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed...

httpd: Weak Digest auth nonce generation in mod_auth_digest

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed...

Apache 2.4.x < 2.4.33 Multiple Vulnerabilities

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.33. It is, therefore, affected by multiple vulnerabilities: - An out of bounds write vulnerability exists in modauthnzldap with AuthLDAPCharsetConfig enabled. An unauthenticated, remote attacker can...

Authentication Bypass By Sniffing Valid Network Requests

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the...

CVE-2018-0474

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest credentials in clear text. The vulnerability is due to the incorrect inclusion of saved passwords in configuration pages. An attacker could...