CVE-2018-11409

Splunk through 7.0.1 allows information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key...

CVE-2016-1000346

CVE-2016-1000346 is a vulnerability in the Bouncy Castle JCE Provider where, in version 1.55 and earlier, the other party's DH public key was not fully validated during Diffie-Hellman key exchange, enabling potential leakage of private key details. Release 1.56 added parameter checks on the agree...

ALPINE-CVE-2018-0737

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev Affected 1.1.0-1.1.0h...

CVE-2018-7506

The private key of the web server in Moxa MXview versions 2.8 and prior is able to be read and accessed via an HTTP GET request, which may allow a remote attacker to decrypt encrypted information...

CVE-2017-5189

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

pulp: Leakage of CA key in pulp-qpid-ssl-cfg

It was found that the private CA key was created in a directory that is world-readable for a small amount of time. A local user could possibly use this flaw to gain access to the private key information in the file...

UBUNTU-CVE-2016-3954

web2py before 2.14.2 allows remote attackers to obtain the sessioncookiekey value via a direct request to examples/simpleexamples/status. NOTE: this issue can be leveraged by remote attackers to execute arbitrary code using CVE-2016-3957...

CVE-2017-13663

Encryption key exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to decrypt log files via an exposed key...

Code injection

Encryption key exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to decrypt log files via an exposed key...

CVE-2017-13663

Encryption key exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to decrypt log files via an exposed key...

CVE-2014-8357

backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attackers to obtain arbitrary user passwords via the sessionKey parameter in a getConfig action to backupsettings.conf...

Red Hat FreeIPA Arbitrary Certificate Issuance Vulnerability

Red Hat FreeIPA is an integrated security information management solution from Red Hat, Inc. The solution provides an easy-to-manage identity, policy and audit IPA suite for Linux and Unix computer networks. A security vulnerability in ipa-kra-install in Red Hat FreeIPA versions prior to 4.2.2...

ALPINE-CVE-2017-0379

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c...

openssl: Non-constant time codepath followed for certain operations in DSA implementation

It was discovered that OpenSSL did not always use constant time operations when computing Digital Signature Algorithm DSA signatures. A local attacker could possibly use this flaw to obtain a private DSA key belonging to another user or service running on the same system...

CFME: default certificate used across all installs

CloudForms includes a default SSL/TLS certificate for the web server. This certificate is replaced at install time. However if an attacker were able to man-in-the-middle an administrator while installing the new certificate, the attacker could get a copy of the uploaded private key allowing for...

CVE-2016-7835

Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service DoS or obtain server certificate private keys and possibly other information...

CVE-2016-3107

CVE-2016-3107 affects Pulp: the Node certificate private key is stored in a world‑readable file under /etc/pki/pulp/nodes/, enabling local users to access sensitive data. Affected versions: Pulp before 2.8.3. Root cause: insecure file permissions on the node certificate. Impact: potential disclos...

Western Digital TV Media Player Multiple critical vulnerabilities

Exploit for hardware platform in category web applications title: Multiple critical vulnerabilities product: Western Digital TV Media Player vulnerable version: 1.03.07 fixed version: - CVE number: - impact: Critical homepage: https://www.wdc.com found: 2017-01-17 by: Wan Ikram Office Kuala Lumpu...

CVE-2016-6668

The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17; and HipChat for JIRA plugin 6.26.0 before 7.8.17 allows remote attackers to obtain the secret key for communicating wit...

Directory Traversal

Overview hostr is a simple web server for the current working directory. Used for hello world style web sites hosting only files in current directory structure. Watches files and integrates with LiveReload. Affected versions of the package do not filter http GET requests in javascript code,...