200 matches found
SolarWinds Serv-U MFT Information Disclosure Vulnerability
SolarWinds Serv-U MFT is a set of U.S. SolarWinds FTP server software. A security vulnerability exists in SolarWinds Serv-U MFT versions prior to 15.1.6 HFv1, which stems from the program assigning session tokens with low entropy values to authenticated users, and the program requesting the token...
CVE-2018-10240
SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session...
CVE-2018-10240
SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session...
Session fixation
SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session...
Lenovo XClarity Controller (XCC) Risk of Low Entropy - us
Lenovo Security Advisory: LEN-17904 Potential Impact: An attacker could eavesdrop on encrypted SSH or https-based systems management communications web UI, Redfish, CIM with the server’s XClarity Controller, or spoof the XCC and thereby capture user access credentials for the XCC. The XCC is also...
Lenovo XClarity Controller (XCC) Risk of Low Entropy - Lenovo Support US
No description provided...
The vulnerability of the Linux operating system, which allows a malicious individual to trigger a service failure
A malfunction in the ANSI pseudo-random number generator leads to the use of a lower entropy, which results in a failure in service...
ALPINE-CVE-2016-5300
The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876...
Uber: Estimation of a Lower Bound on Number of Uber Drivers via Enumeration
@ddworken discovered a way to estimate a lower bound on the number of Uber drivers via an endpoint with low entropy. Thanks for the report @ddworken! Good summary from @Uber, just wanted to clarify that we are sticking to limited disclosure since this issue was only patched moving forward so not...
Pixiewps - Bruteforce Offline the WPS Pin (Pixie Dust Attack)
Pixiewps is a tool written in C used to bruteforce offline the WPS pin exploiting the low or non-existing entropy of some APs pixie dust attack. It is meant for educational purposes only. All credits for the research go to Dominique Bongard. DEPENDENCIES Pixiewps requires libssl. To install it:...
Juniper Junos QFX Low Entropy Vulnerability (JSA10678)
According to its self-reported version number, the remote Juniper Junos device is affected by a low entropy vulnerability due to an insufficient number of bytes being collected from the RANDOMINTERRUPT entropy source when the device is first booted, thus resulting in the generation of weak SSH ke...
PT-2017-6668 · Nts +3 · Ntp +3
Name of the Vulnerable Software and Affected Versions: ntp versions 4.2.8px through 4.2.8p2-RC2 ntp versions 4.3.x through 4.3.12 Description: The issue is related to the generation of MD5 keys with insufficient entropy on big endian machines under specific conditions. This might allow remote...
F5 Networks BIG-IP : Hosts may generate weak RSA keys under low entropy conditions (SOL13607)
A recent study, linked in the Supplemental Information section, has revealed that when a system generates new RSA keys under low-entropy conditions, such as during the first system boot, the resulting keys may not be cryptographically strong. C Tenable Network Security, Inc. The descriptive text...
[Haveged 1.9.1] A simple entropy daemon
The haveged project is an attempt to provide an easy-to-use, unpredictable random number generator based upon an adaptation of the HAVEGE algorithm. Haveged was created to remedy low-entropy conditions in the Linux random device that can occur under some workloads, especially on headless servers...
[Haveged] A simple Entropy Daemon
The haveged project is an attempt to provide an easy-to-use, unpredictable random number generator based upon an adaptation of the HAVEGE algorithm. Haveged was created to remedy low-entropy conditions in the Linux random device that can occur under some workloads, especially on headless servers...
SOL13607 - Hosts may generate weak RSA keys under low entropy conditions
A recent study, linked in the Supplemental Information section, has revealed that when a system generates new RSA keys under low-entropy conditions, such as during the first system boot, the resulting keys may not be cryptographically strong. During its first boot, the BIG-IP system generates...
DEBIAN-CVE-2008-7278
The S/MIME feature in Open Ticket Request System OTRS before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available fo...
RHEL 6 : krb5 (RHSA-2010:0925)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0925 advisory. Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a...
krb5: krb5 may accept authdata checksums with low-entropy derived keys (MITKRB5-SA-2010-007)
MIT Kerberos 5 aka krb5 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a 1 AD-SIGNEDPATH or 2 AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte...