Siemens Patches Insufficient Entropy Vulnerability in ICS Systems

German industrial giant Siemens has provided a firmware update addressing vulnerabilities that are found in a popular line of its Desigo PX industrial control hardware used in controlling primarily HVAC systems in commercial buildings . On Wednesday, Siemens, in coordination with ICS-CERT, issued...

Netgear WNR2000v5 - Remote Code Execution

Remote code execution in NETGEAR WNR2000v5 - by Pedro Ribeiro [email protected] / Agile Information Security Released on 20/12/2016 NOTE: this exploit is "alpha" quality and has been deprecated. Please see the modules accepted into the Metasploit framework, or...

Entropy Insufficiency Vulnerability in Pseudo-Random Number Generation in SIEMENS Desigo PX Web Module

SIEMENS Building Automation Systems Desigo PX programmable automation station offers a flexible solution with the ability to signal alarms, time-based logging programs and trends that can be modified or expanded at any time. An entropy insufficiency vulnerability exists in the pseudo-random numbe...

CVE-2016-6313

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits...

CVE-2016-6313

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits...

DEBIAN-CVE-2016-6313

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits...

Design/Logic Flaw

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits...

CVE-2016-6313

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits...

CVE-2016-6313

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits...

CVE-2016-6313

CVE-2016-6313 documents a design flaw in Libgcrypt’s random-number generator mixing functions (affecting Libgcrypt <1.5.6, <1.6.6 in 1.6.x, <1.7.3 in 1.7.x, and GnuPG

CVE-2016-6313

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits...

PHP FormMail Generator Security Bypass Vulnerability (CNVD-2016-12387)

PHP FormMail Generator is a suite of PHP applications for generating standard web forms for inclusion in PHP or WordPress websites. A security bypass vulnerability exists in PHP FormMail Generator. The vulnerability stems from the program incorrectly detecting a folder directory entered by the...

PHP FormMail Generator Security Bypass Vulnerability (CNVD-2016-12386)

PHP FormMail Generator is a suite of PHP applications for generating standard web forms for inclusion in PHP or WordPress websites. A security bypass vulnerability exists in PHP FormMail Generator. A remote attacker can exploit this vulnerability to inject PHP code or perform unauthorized...

PHP FormMail Generator Security Bypass Vulnerability

PHP FormMail Generator is a suite of PHP applications for generating standard web forms for inclusion in PHP or WordPress websites. A security bypass vulnerability exists in PHP FormMail Generator. A remote attacker can use this vulnerability to bypass authentication and gain administrator access...

ALPINE-CVE-2016-6631

An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Under certain server configurations, a user can pass a query string which is executed as a command-line argument by the file...

DEBIAN-CVE-2016-6631

An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Under certain server configurations, a user can pass a query string which is executed as a command-line argument by the file...

UBUNTU-CVE-2016-6631

An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Under certain server configurations, a user can pass a query string which is executed as a command-line argument by the file...

PHP FormMail Generator generates code with multiple vulnerabilities

Overview PHP FormMail Generator is a single-instance website that generates PHP code for standard web forms for inclusion into PHP or WordPress websites. The generated code is vulnerable to authentication bypass and unsafe deserialization of untrusted data. Description CWE-302: Authentication...

Scientific Linux Security Update : libgcrypt on SL6.x i386/x86_64 (20161108)

Security Fixes : - A design flaw was found in the libgcrypt PRNG Pseudo-Random Number Generator. An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes. CVE-2016-6313 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C...

libgcrypt: PRNG output is predictable

A design flaw was found in the libgcrypt PRNG Pseudo-Random Number Generator. An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes...