348 matches found
MySQL 5.6.x < 5.6.30 Multiple Vulnerabilities (DROWN)
The version of MySQL running on the remote host is 5.6.x prior to 5.6.30. It is, therefore, affected by multiple vulnerabilities : - A cipher algorithm downgrade vulnerability exists in the bundled version of OpenSSL due to a flaw that is triggered when handling cipher negotiation. A remote...
MySQL 5.7.x < 5.7.12 Multiple Vulnerabilities (DROWN)
The version of MySQL running on the remote host is 5.7.x prior to 5.7.12. It is, therefore, affected by multiple vulnerabilities : - A cipher algorithm downgrade vulnerability exists in the bundled version of OpenSSL due to a flaw that is triggered when handling cipher negotiation. A remote...
AIX OpenSSL Advisory : openssl_advisory18.asc / openssl_advisory19.asc (DROWN)
The version of OpenSSL installed on the remote AIX host is affected by the following vulnerabilities : - A key disclosure vulnerability exists due to improper handling of cache-bank conflicts on the Intel Sandy-bridge microarchitecture. An attacker can exploit this to gain access to RSA key...
OpenSSL 1.0.1 < 1.0.1s / 1.0.2 < 1.0.2g Multiple Vulnerabilities (DROWN)
Binary data 801963.prm...
OpenSSL re-uses unsafe prime numbers in Diffie-Hellman protocol
Overview OpenSSL may generate unsafe primes for use in the Diffie-Hellman protocol, which may lead to disclosure of enough information for an attacker to recover the private encryption key. Description CWE-325: Missing Required Cryptographic Step - CVE-2016-0701OpenSSL 1.0.2 introduced the abilit...
Cisco Small Business RV Router Information Disclosure Vulnerability
The Cisco Small Business RV Series routers provide virtual private network technology remote. Cisco Small Business RV Routers 4.x, SA500 Security Appliance Version 2.2.07 random number generator fails to have effective entropy, which can allow a remote attacker to determine the TLS key pair throu...
UBUNTU-CVE-2015-3863
Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob in an insert operation, aka internal bug 22802399...
Libcrypt++ Private Key Disclosure Vulnerability
libcrypt is an ANSI C encryption library. A private key disclosure vulnerability exists in libcrypt++, which allows remote attackers to obtain a private key via a timing attack...
Ceragon FiberAir IP-10 Private Key Vulnerability
The Ceragon FiberAir IP-10 is a wireless microwave transmission device from Ceragon Israel. The Ceragon FiberAir IP-10 SSH private key disclosure vulnerability allows remote attackers to exploit the vulnerability to gain unauthorized access to the device...
FreeBSD 10.x ZFS encryption.key disclosure (CVE-2015-1415)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory Information Title: FreeBSD 10.x ZFS encryption.key disclosure CVE-2015-1415 Advisory URL: https://pierrekim.github.io/advisories/CVE-2015-1415.txt.asc Date published: 2015-04-07 Vendors contacted: FreeBSD Release mode: Coordinated release...
Debian DLA-173-1 : putty security update
MATTA-2015-002 Florent Daigniere discovered that PuTTY did not enforce an acceptable range for the Diffie-Hellman server value, as required by RFC 4253, potentially allowing an eavesdroppable connection to be established in the event of a server weakness. 779488 CVE-2015-2157 Patrick Coleman...
[SECURITY] [DLA 173-1] putty security update
Package : putty Version : 0.60+2010-02-20-1+squeeze3 CVE ID : CVE-2015-2157 Debian Bug : 779488 MATTA-2015-002 Florent Daigniere discovered that PuTTY did not enforce an acceptable range for the Diffie-Hellman server value, as required by RFC 4253, potentially allowing an eavesdroppable connectio...
DLA-173-1 putty - security update
Bulletin has no description...
PHP < 4.4.5 / 5.2.1 (shmop) SSL RSA Private-Key Disclosure Exploit
No description provided by source. ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP...
Design/Logic Flaw
Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by reading the file...
Parallels Plesk Panel 12.x Key Disclosure
While auditing the source code for Parallels Plesk Panel 12.x on Linux I noticed the following feature that leads to leakage of the '/etc/psa/private/secretkey'-file in md5 format to non-authenticated users. Parallels responded that the 16byte 'secretkey' should provide sufficient entropy for thi...
WinSCP < 5.1.7 Multiple Vulnerabilities
The WinSCP program installed on the remote host is a version prior to 5.1.7. It therefore contains code from PuTTY that is affected by the following vulnerabilities related to PuTTY : - An overflow error exists that allows heap corruption when handling DSA signatures. CVE-2013-4206 - A buffer...
OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069)
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle ha...
Bio Basespace SDK Gem for Ruby Command Line API Key Disclosure
Bio Basespace SDK Gem for Ruby contains a flaw that is due to the API client code passing the APIKEY to a curl command. This may allow a local attacker to gain access to API key information by monitoring the process table...
CVE-2013-4425: Private key disclosure, Osirix (lite, 64bit and FDA cleader version) (Medical Application)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Private key disclosure, Osirix lite, 64bit and FDA cleader version CVE-2013-4425 version 1.09 CVSS Score: 8.4 Background: =========== OsiriX is an image processing software dedicated to DICOM images files with a ".dcm" / ".DCM" extension produced by...