803 matches found
UBUNTU-CVE-2015-3167
contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack...
wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487)
It was found that a prior countermeasure in Apache WSS4J for Bleichenbacher's attack on XML Encryption CVE-2011-2487 threw an exception that permitted an attacker to determine the failure of the attempted attack, thereby leaving WSS4J vulnerable to the attack. The original flaw allowed a remote...
USN-2554-1 gnupg, gnupg2 vulnerabilities
Daniel Genkin, Lev Pachmanov, Itamar Pipman, and Eran Tromer discovered that GnuPG was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys. CVE-2014-3591 Daniel Genkin, Adi Shamir, and Eran Tromer discovered that GnuPG was...
openssl: Divide-and-conquer session key recovery in SSLv2
It was discovered that the SSLv2 servers using OpenSSL accepted SSLv2 connection handshakes that indicated non-zero clear key length for non-export cipher suites. An attacker could use this flaw to decrypt recorded SSLv2 sessions with the server by using it as a decryption oracle...
JDK: Java CMS keystore provider potentially allows brute-force private key recovery
IBM Java Runtime Environment JRE 7 R1 before SR1 FP1 7.1.1.1, 7 before SR7 FP1 7.0.7.1, 6 R1 before SR8 FP1 6.1.8.1, 6 before SR16 FP1 6.0.16.1, and before 5.0 SR16 FP7 5.0.16.7 allows attackers to obtain the private key from a Certificate Management System CMS keystore via a brute force attack...
Barracuda Load Balancer ADC Key Recovery / Password Reset Vulnerabilities
Barracuda Load Balancer ADC with firmware version 5.0.0.015 suffers from multiple security issues. There is an ability to recover the file system encryption keys via simil cold-boot attack, an off-line super user password reset via physical attack, hard-coded credential and hard-coded ssh key...
JDK: Java CMS keystore provider potentially allows brute-force private key recovery
IBM Java Runtime Environment JRE 7 R1 before SR1 FP1 7.1.1.1, 7 before SR7 FP1 7.0.7.1, 6 R1 before SR8 FP1 6.1.8.1, 6 before SR16 FP1 6.0.16.1, and before 5.0 SR16 FP7 5.0.16.7 allows attackers to obtain the private key from a Certificate Management System CMS keystore via a brute force attack...
JDK: Java CMS keystore provider potentially allows brute-force private key recovery
IBM Java Runtime Environment JRE 7 R1 before SR1 FP1 7.1.1.1, 7 before SR7 FP1 7.0.7.1, 6 R1 before SR8 FP1 6.1.8.1, 6 before SR16 FP1 6.0.16.1, and before 5.0 SR16 FP7 5.0.16.7 allows attackers to obtain the private key from a Certificate Management System CMS keystore via a brute force attack...
JDK: Java CMS keystore provider potentially allows brute-force private key recovery
IBM Java Runtime Environment JRE 7 R1 before SR1 FP1 7.1.1.1, 7 before SR7 FP1 7.0.7.1, 6 R1 before SR8 FP1 6.1.8.1, 6 before SR16 FP1 6.0.16.1, and before 5.0 SR16 FP7 5.0.16.7 allows attackers to obtain the private key from a Certificate Management System CMS keystore via a brute force attack...
JDK: Java CMS keystore provider potentially allows brute-force private key recovery
IBM Java Runtime Environment JRE 7 R1 before SR1 FP1 7.1.1.1, 7 before SR7 FP1 7.0.7.1, 6 R1 before SR8 FP1 6.1.8.1, 6 before SR16 FP1 6.0.16.1, and before 5.0 SR16 FP7 5.0.16.7 allows attackers to obtain the private key from a Certificate Management System CMS keystore via a brute force attack...
OpenSSL security vulnerabilities
Information leakage, key recovery. This vulnerability is actively used in-the-wild...
ProduKey - Recover lost Windows product key (CD-Key) and Office 2003/2007 product key
ProduKey is a small utility that displays the ProductID and the CD-Key of Microsoft Office Microsoft Office 2003, Microsoft Office 2007, Windows Including Windows 7 and Windows Vista, Exchange Server, and SQL Server installed on your computer. You can view this information for your current runnin...
Exploit for Out-of-bounds Read in Openssl
OpenSSL Heartbleed CVE-2014-0160 vulnerability scanner, dat...
OpenSSL Heartbeat (Heartbleed) Information Leak
This module implements the OpenSSL Heartbleed attack. The problem exists in the handling of heartbeat requests, where a fake length can be used to leak memory data in the response. Services that support STARTTLS may also be vulnerable. The module supports several actions, allowing for scanning,...
GLSA-201402-24 : GnuPG, Libgcrypt: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201402-24 GnuPG, Libgcrypt: Multiple vulnerabilities Multiple vulnerabilities have been discovered in GnuPG and Libgcrypt. Please review the CVE identifiers referenced below for details. Impact : An unauthenticated remote attacker...
[SterJo Key Finder v.1.6] Tool to recover lost product keys
SterJo Key Finder is a small and FREE application that can recover lost product keys. All you have to do is run the program and it will find the keys for you in a few seconds. The software is currently able to recover a large number of keys like Microsoft Windows, Microsoft Office, WinZip, Corel...
gnupg / libcrypt RSA implementation flush+reload timing attack
Private key recovery by using CPU L3 cache timings...
jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key
A flaw was found in JBoss web services where the services used a weak symmetric encryption protocol, PKCS1 v1.5. An attacker could use this weakness in chosen-ciphertext attacks to recover the symmetric key and conduct further attacks...
jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key
A flaw was found in JBoss web services where the services used a weak symmetric encryption protocol, PKCS1 v1.5. An attacker could use this weakness in chosen-ciphertext attacks to recover the symmetric key and conduct further attacks...
jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key
A flaw was found in JBoss web services where the services used a weak symmetric encryption protocol, PKCS1 v1.5. An attacker could use this weakness in chosen-ciphertext attacks to recover the symmetric key and conduct further attacks...