PT-2016-7233 · Inspircd +2 · Inspircd +2

Name of the Vulnerable Software and Affected Versions: InspIRCd versions prior to 2.0.23 Description: The issue allows remote attackers to spoof certificate fingerprints, enabling them to log in as another user by sending a crafted SASL message when the m sasl module is used with a service that...

jenkins: Project name disclosure via fingerprints (SECURITY-153)

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request...

Machinae - Security Intelligence Collector

Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints. It was inspired by Automater , another excellent tool for collecting information. The Machinae...

Security Intelligence Collector: Machinae

Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints. It was inspired by Automater , another excellent tool for collecting information. The Machinae...

jenkins: Project name disclosure via fingerprints (SECURITY-153)

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request...

CloudBees Jenkins Information Disclosure Vulnerability (CNVD-2015-07827)

CloudBees Jenkins is the open source continuous integration server. CloudBees Jenkins 1.638, LTS 1.625.2 or earlier, a security vulnerability exists in the Fingerprints page, which allows a remote attacker to obtain sensitive job and build name information through a direct request...

CVE-2015-5317

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request...

PT-2015-6850 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 1.638 Jenkins LTS versions prior to 1.625.2 Description: The issue allows remote attackers to obtain sensitive job and build name information via a direct request to the Fingerprints pages. This is an information...

5.6 Million Federal Employees' Fingerprints Stolen in OPM Hack

The OPM Data Breach Office of Personnel Management is getting even worse than we thought. We already know more than 21 Million current and former federal employees had their personal and highly sensitive private information hijacked in a massive data breach that affected Defense Department's OPM...

5.6 Million Fingerprints Stolen In OPM Hack

It turns out roughly 5.6 million federal employees may have had their fingerprints stolen as part of this year’s mammoth Office of Personnel Management breach – a figure five times what the agency initially announced in June. OPM press secretary Sam Schumach broke the bad news Wednesday morning,...

Hackers Can Remotely Steal Fingerprints From Android Phones

Over a year ago I wrote an article on The Hacker News that warned of serious security concerns created by the iPhone and Android’s Fingerprint authentication. Till now hackers were impersonated simply by lifting prints off the side of a phone and gaining unauthorized access to user's phone and th...

openssl: Fix various certificate fingerprint issues

Multiple flaws were found in the way OpenSSL parsed X.509 certificates. An attacker could use these flaws to modify an X.509 certificate to produce a certificate with a different fingerprint without invalidating its signature, and possibly bypass fingerprint-based blacklisting in applications...

Ubuntu 14.04 LTS : OpenSSL vulnerabilities (USN-2459-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2459-1 advisory. Pieter Wuille discovered that OpenSSL incorrectly handled Bignum squaring. CVE-2014-3570 Markus Stenberg discovered that OpenSSL incorrectly handled...

USN-2459-1: OpenSSL vulnerabilities

Pieter Wuille discovered that OpenSSL incorrectly handled Bignum squaring. CVE-2014-3570 Markus Stenberg discovered that OpenSSL incorrectly handled certain crafted DTLS messages. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. CVE-2014-3571...

OpenSSL Certificate fingerprints local security bypass vulnerability

OpenSSL is an open source implementation of SSL used to enable strong encryption of network communications and is now widely used in a variety of web applications. A local security bypass vulnerability exists in OpenSSL, which can be exploited by a local attacker to bypass certain security...

Vulnerability in OpenSSL - Certificate fingerprints can be modified

OpenSSL accepts several non-DER-variations of certificate signature algorithm and signature encodings. OpenSSL also does not enforce a match between the signature algorithm between the signed and unsigned portions of the certificate. By modifying the contents of the signature algorithm or the...

WPScan - WordPress Security Scanner

WPScan is a black box WordPress vulnerability scanner. Features Username enumeration from author querystring and location header Weak password cracking multithreaded Version enumeration from generator meta tag and from client side files Vulnerability enumeration based on version Plugin enumeratio...

DEBIAN-CVE-2011-4407

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle MITM attackers to spoof GPG keys for a package repository...

CVE-2011-4407

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle MITM attackers to spoof GPG keys for a package repository...

Code injection

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle MITM attackers to spoof GPG keys for a package repository...