4632 matches found
USN-3064-1 gnupg vulnerability
Felix Dörre and Vladimir Klebanov discovered that GnuPG incorrectly handled mixing functions in the random number generator. An attacker able to obtain 4640 bits from the RNG can trivially predict the next 160 bits of output...
GPG Patches 18-Year-Old Libgcrypt RNG Bug
New versions of Libgcrypt and Gnu Privacy Guard GnuPG or GPG released on Wednesday include security fixes for vulnerabilities discovered in the mixing functions of the Libgcrypt random number generator. The flaws were privately disclosed by Felix Dörre and Vladimir Klebanov of Karlsruhe Institute...
UBUNTU-CVE-2016-6313
The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits...
guard-host.net XSS vulnerability
Vulnerable URL: https://guard-host.net/whois.php?domain='" Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 23:33 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1926067 VIP website status:| No Check...
Open-Xchange: OX Guard: DOM Based Cross-Site Scripting
Summary OX Guard's "Guest Reader" is vulnerable to DOM Based XSS. The vulnerable parameter is "templid". The reader.js script see below takes the parameter's value and injects it into the page/DOM without encoding/sanitizing it first. PoC:...
[SECURITY] Fedora 23 Update: libgcrypt-1.6.5-1.fc23
Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...
Open-Xchange: OX (Guard): Stored Cross-Site Scripting via Incoming Email
Summary "OX Guard" introduces a Stored Cross-Site Scripting XSS vulnerability to the frontend. HTML/JS code can be injected into the frontend through an incoming email. Injected code will be executed = become part of the DOM the moment the victim opens the email. The vulnerability allows for...
[SECURITY] Fedora 24 Update: libgcrypt-1.6.5-1.fc24
Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...
Open-Xchange OX Guard Security Bypass Vulnerability
Open-Xchange OX Guard is a suite of security protection software for e-mail and files from Open-Xchange USA. A security bypass vulnerability exists in versions 2.0 and 2.2.0 of Open-Xchange OX Guard, which can be exploited by attackers to bypass security restrictions and perform unauthorized...
Cerber: Analyzing a Ransomware Attack Methodology To Enable Protection
Ransomware is a common method of cyber extortion for financial gain that typically involves users being unable to interact with their files, applications or systems until a ransom is paid. Accessibility of cryptocurrency such as Bitcoin has directly contributed to this ransomware model. Based on...
Cerber: Analyzing a Ransomware Attack Methodology To Enable Protection
Ransomware is a common method of cyber extortion for financial gain that typically involves users being unable to interact with their files, applications or systems until a ransom is paid. Accessibility of cryptocurrency such as Bitcoin has directly contributed to this ransomware model. Based on...
Cerber: Analyzing a Ransomware Attack Methodology To Enable Protection
Ransomware is a common method of cyber extortion for financial gain that typically involves users being unable to interact with their files, applications or systems until a ransom is paid. Accessibility of cryptocurrency such as Bitcoin has directly contributed to this ransomware model. Based on...
Open-Xchange Guard Information Disclosure Vulnerability
Open-Xchange Guard OX Guard is a suite of security protection software for e-mail and files from Open-Xchange, Inc. in the United States. An information disclosure vulnerability exists in OX Guard version 2.4.0, which originates when the program returns a different error code. A remote attacker...
search-guard in Elasticsearch 2.3 use-vulnerability warning-the black bar safety net
Reference content： http://kibana.logstash.es/content/elasticsearch/auth/searchguard-2.html https://groups.google.com/forum/! forum/search-guard https://github.com/floragunncom/search-guard This article is based on the following software versions, different versions may have slightly differences:...
Open-Xchange App Suite 7.8.1 Information Disclosure
Product: OX App Suite Vendor: OX Software GmbH Internal reference: 45328 Bug ID Vulnerability type: Information Exposure CWE-200 Vulnerable version: 7.8.1 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.2-rev43,...
lib32-glibc: denial of service
clntudpcall allocates a buffer, using alloca, to store the payload of an incoming socket error. If a malicious server floods the client with crafted ICMP and UDP packets, this can cause the client to allocate sufficiently many such temporary buffers to cause a stack frame overflow denial of...
Microsoft Internet Explorer Security Feature Bypass Vulnerability
Microsoft Internet Explorer IE is a Web browser developed by the American company Microsoft and is the default browser that comes with the Windows operating system. A security feature bypass vulnerability exists in the User Mode Code Integrity UMCI component of Device Guard in Microsof IE version...
CVE-2016-0188
The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...
Security feature bypass
The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...
CVE-2016-0188
The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...