CVE-2019-9894

A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification...

ALPINE-CVE-2019-9894

A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification...

Authentication flaw

A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification...

CVE-2019-9894

A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification...

UBUNTU-CVE-2019-9894

A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification...

CVE-2019-9894

PuTTY (before 0.71) is affected by CVE-2019-9894: a remotely triggerable memory overwrite can occur during RSA key exchange prior to host key verification. Open-source advisories and vendor updates indicate this was addressed in PuTTY 0.71 and newer. The vulnerability enables memory corruption wi...

CVE-2019-9894

A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification...

CVE-2019-9894

A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification...

hp-plugin driver Code Execution

The vulnerability of the hp-plugin driver for HPLIP printers is related to the use of a short key identifier GPG from the key server, which is used to verify the loading of the printing plugin. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Zendesk: Leaked artifactory_api_key via GitHub.

It was reported to Zendesk that a valid API key to an instance of Artifactory was unintentionally leaked via a public GitHub repository. We immediately rotated the key and investigated to ensure it was not utilized by any other party. We want to thank @rubyroobs for providing a detailed report...

GHSA-CMWX-9M2H-X7V4 Ansible apt_key module does not properly verify key fingerprint

A flaw was found in Ansible before version 2.2.0.0. The aptkey module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key...

Ansible apt_key module does not properly verify key fingerprint

A flaw was found in Ansible before version 2.2.0.0. The aptkey module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key...

Improper Key Verification

Overview Versions 0.1.1 or 0.1.2 of ipns are vulnerable to improper key validation. This is due to the public key verification was not being performed properly, resulting in any key being valid. Recommendation Update to version 0.1.3 or later. References -...

CVE-2017-2648

It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks...

CVE-2017-2648

It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks...

CVE-2017-2648

The CVE-2017-2648 issue affects the Jenkins SSH Slaves Plugin; before version 1.15 it did not verify host keys, enabling Man-in-the-Middle attacks. Impact is network-based, with potential for interception of communications between the master and agents. The commonly cited remediation is to upgrad...

CVE-2017-2648

It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks...

PT-2018-7156

Name of the Vulnerable Software and Affected Versions: jenkins-ssh-slaves-plugin versions prior to 1.15 Description: The issue allows for Man-in-the-Middle attacks due to the lack of host key verification. Recommendations: For versions prior to 1.15, update to version 1.15 or later to resolve the...

CVE-2017-2648: Improper Certificate Validation

It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks...

Design/Logic Flaw

The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this fl...