Security Bulletin: Vulnerability in IBM Java SDK affects IBM InfoSphere Discovery (CVE-2015-7575)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 6 that is used by IBM InfoSphere Discovery. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Algo Credit Limits (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM Algo Credit Limits. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly...

Security Bulletin: Aspera Applications are affected by an OpenSSL vulnerability (CVE-2016-8610)

Summary Aspera Applications has addressed the following OpenSSL vulnerability. Vulnerability Details CVEID:CVE-2016-8610 DESCRIPTION: SSL/TLS protocol is vulnerable to a denial of service, caused by an error when processing ALERT packets during a SSL handshake. By sending specially-crafted packet...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM MQ Appliance (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM MQ Appliance Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during...

Security Bulletin: Malformed client flows abend MQTT channel (CVE-2015-4943, CVE-2015-4941, CVE-2015-4942)

Summary A number of malformed MQTT client flows could be issued by a malicious user to cause the MQXR service to abend and require manual restart. Vulnerability Details CVEID: CVE-2015-4943 DESCRIPTION: IBM WebSphere MQ could allow a remote attacker to crash the MQXR service using a sequence of...

Security Bulletin: IBM MQ Light is vulnerable to a remote attack on the MQXR service (CVE-2015-4941)

Summary IBM MQ Light could allow a remote attacker to crash the MQXR service due to incorrect handling of abbreviated TLS handshake. Vulnerability Details CVEID: CVE-2015-4941 DESCRIPTION: IBM WebSphere MQ could allow a remote attacker to crash the MQXR service due to incorrect handling of...

Security Bulletin: SSLv3 POODLE attack vulnerability affects IBM Image Construction and Composition Tool (CVE-2014-3566)

Summary A vulnerability within IBM Image Construction and Composition Tool’s usage of SSLv3 might allow a man-in-the-middle attacker to access the plain text of network traffic encrypted using SSLv3. This vulnerability has been dubbed the Padding Oracle On Downgraded Legacy Encryption POODLE...

rtorrent 0.9.6 - Denial of Service Exploit

Exploit for linux platform in category dos / poc Exploit Title: rtorrent 0.9.6 - Denial of Service Exploit Author: ecx86 Vendor Homepage: http://rtorrent.net Software Link: https://github.com/rakshasa/rtorrent/releases Version: I', lenmsg crash += msg s = socket.socketsocket.AFINET,...

rtorrent 0.9.6 - Denial of Service

Exploit Title: rtorrent 0.9.6 - Denial of Service Date: 2018-01-10 Exploit Author: ecx86 Vendor Homepage: http://rtorrent.net Software Link: https://github.com/rakshasa/rtorrent/releases Version: I', lenmsg crash += msg s = socket.socketsocket.AFINET, socket.SOCKSTREAM s.connect'1.3.3.7', 6890...

rtorrent 0.9.6 Denial Of Service

Exploit Title: rtorrent 0.9.6 - Denial of Service Date: 2018-01-10 Exploit Author: ecx86 Vendor Homepage: http://rtorrent.net Software Link: https://github.com/rakshasa/rtorrent/releases Version: I', lenmsg crash += msg s = socket.socketsocket.AFINET, socket.SOCKSTREAM s.connect'1.3.3.7', 6890...

DEBIAN-CVE-2018-7162

All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service DoS by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshak...

Denial Of Service (DoS)

openssl is vulnerable to denial of service DoS attacks. A malicious user can pass a large prime number during a TLS handshake that can cause the client to take a long time generating a key for this, leading to the client hanging and possibly crashing...

PT-2018-17923 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js versions 9.x through 10.x Description: The issue allows an attacker to cause a denial of service DoS by crashing a node process that provides an http server supporting TLS server. This can be accomplished by sending duplicate or...

Airba.sh - A POSIX-compliant, Fully Automated WPA PSK Handshake Capture Script Aimed At Penetration Testing

Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing. It is compatible with Bash and Android Shell tested on Kali Linux and Cyanogenmod 10.2 and uses aircrack-ng to scan for clients that are currently connected to access points AP. Those...

CVE-2018-0732

During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This...

CVE-2018-0732

During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This...

CVE-2018-0732 Client DoS due to large DH parameter

During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This...

CVE-2018-0732

During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This...

CVE-2018-0732

CVE-2018-0732 : OpenSSL vulnerability where, during TLS handshakes using DH(E) ciphersuites, a malicious server could send an excessively large prime, causing the client to spend an unreasonably long time computing a key and hang (DoS). The issue is specific to DH parameters during the Server Key...

CVE-2018-0732

During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This...