Juniper Junos Multiple OpenSSL Vulnerabilities (JSA10759) (SWEET32)

According to its self-reported version number, the remote Juniper Junos device is affected by the following vulnerabilities related to OpenSSL : - A flaw exists in the ssl3getkeyexchange function in file s3clnt.c when handling a ServerKeyExchange message for an anonymous DH ciphersuite with the...

Netgear DGN2200 / DGND3700 / WNDR4500 Information Disclosure Vulnerability

Netgear models DGN2200, DGND3700, and WNDR4500 suffer from multiple information disclosure vulnerabilities, one of which leaks the admin password. Title: Netgear DGN2200, DGND3700 and WNDR4500 Multiple Information Disclosure Vulnerabilities Author: Mandar jadhav Vendor Homepage:...

Atlassian Confluence Server 5.9.x < 5.9.14 Secret Key Disclosure

Binary data 9649.prm...

Atlassian Confluence Server 5.10.x < 5.10.4 Secret Key Disclosure

Binary data 9650.prm...

USN-3087-1 openssl vulnerabilities

Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request extension. A remote attacker could possibly use this issue to cause memory consumption, resulting in a denial of service. CVE-2016-6304 Guido Vranken discovered that OpenSSL used undefined behaviour when performing pointe...

Aruba Networks / Alcatel-Lucent Private Key Disclosure

This advisory is accompanied by a blog post regarding a recap on our published "House of Keys" research study on the re-use of cryptographic secrets from 11/2015. For further information also see http://blog.sec-consult.com/2016/09/house-of-keys-9-months-later-40-worse.html SEC Consult...

Oracle Secure Global Desktop Multiple Vulnerabilities (July 2016 CPU)

The version of Oracle Secure Global Desktop installed on the remote host is 4.63, 4.71, or 5.2 and is missing a security patch from the July 2016 Critical Patch Update CPU. It is, therefore, affected by the following vulnerabilities : - An integer overflow condition exists in the X Server...

CVE-2016-2178: Observable Discrepancy

The dsasignsetup function in crypto/dsa/dsaossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack...

Pulp Private Key Read Vulnerability (CNVD-2016-03572)

Pulp is a free and open source repository platform for managing content. The platform supports pushing content from software packages to consumers. A private key read vulnerability exists in Pulp that stems from the fact that the pulp.spec file is globally readable at certain times. An attacker...

MySQL 5.7.x < 5.7.12 Multiple Vulnerabilities (DROWN)

The version of MySQL running on the remote host is 5.7.x prior to 5.7.12. It is, therefore, affected by multiple vulnerabilities : - A cipher algorithm downgrade vulnerability exists in the bundled version of OpenSSL due to a flaw that is triggered when handling cipher negotiation. A remote...

MySQL 5.6.x < 5.6.30 Multiple Vulnerabilities (DROWN)

The version of MySQL running on the remote host is 5.6.x prior to 5.6.30. It is, therefore, affected by multiple vulnerabilities : - A cipher algorithm downgrade vulnerability exists in the bundled version of OpenSSL due to a flaw that is triggered when handling cipher negotiation. A remote...

AIX OpenSSL Advisory : openssl_advisory18.asc / openssl_advisory19.asc (DROWN)

The version of OpenSSL installed on the remote AIX host is affected by the following vulnerabilities : - A key disclosure vulnerability exists due to improper handling of cache-bank conflicts on the Intel Sandy-bridge microarchitecture. An attacker can exploit this to gain access to RSA key...

OpenSSL 1.0.1 < 1.0.1s / 1.0.2 < 1.0.2g Multiple Vulnerabilities (DROWN)

Binary data 801963.prm...

OpenSSL re-uses unsafe prime numbers in Diffie-Hellman protocol

Overview OpenSSL may generate unsafe primes for use in the Diffie-Hellman protocol, which may lead to disclosure of enough information for an attacker to recover the private encryption key. Description CWE-325: Missing Required Cryptographic Step - CVE-2016-0701OpenSSL 1.0.2 introduced the abilit...

Cisco Small Business RV Router Information Disclosure Vulnerability

The Cisco Small Business RV Series routers provide virtual private network technology remote. Cisco Small Business RV Routers 4.x, SA500 Security Appliance Version 2.2.07 random number generator fails to have effective entropy, which can allow a remote attacker to determine the TLS key pair throu...

UBUNTU-CVE-2015-3863

Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob in an insert operation, aka internal bug 22802399...

Libcrypt++ Private Key Disclosure Vulnerability

libcrypt is an ANSI C encryption library. A private key disclosure vulnerability exists in libcrypt++, which allows remote attackers to obtain a private key via a timing attack...

Ceragon FiberAir IP-10 Private Key Vulnerability

The Ceragon FiberAir IP-10 is a wireless microwave transmission device from Ceragon Israel. The Ceragon FiberAir IP-10 SSH private key disclosure vulnerability allows remote attackers to exploit the vulnerability to gain unauthorized access to the device...

PT-2015-6086

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 9.0.20 PostgreSQL versions 9.1.x prior to 9.1.16 PostgreSQL versions 9.2.x prior to 9.2.11 PostgreSQL versions 9.3.x prior to 9.3.7 PostgreSQL versions 9.4.x prior to 9.4.2 Description The issue allows attackers to...

FreeBSD 10.x ZFS encryption.key disclosure &#40;CVE-2015-1415&#41;

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory Information Title: FreeBSD 10.x ZFS encryption.key disclosure CVE-2015-1415 Advisory URL: https://pierrekim.github.io/advisories/CVE-2015-1415.txt.asc Date published: 2015-04-07 Vendors contacted: FreeBSD Release mode: Coordinated release...