SSH-1 allows client authentication to be forwarded by a malicious server to another server

Overview A design flaw in the SSH-1 protocol allows a malicious server to establish two concurrent sessions with the same session ID, allowing a man-in-the-middle attack. The client must accept unknown host keys from the malicious server to enable exploitation of this vulnerability. Description...

rlogin Service Detection

The rlogin service is running on the remote host. This service is vulnerable since data is passed between the rlogin client and server in cleartext. A man-in-the-middle attacker can exploit this to sniff logins and passwords. Also, it may allow poorly authenticated logins without passwords. If th...

rsh Service Detection

The rsh service is running on the remote host. This service is vulnerable since data is passed between the rsh client and server in cleartext. A man-in-the-middle attacker can exploit this to sniff logins and passwords. Also, it may allow poorly authenticated logins without passwords. If the host...

alibaba.2.0.genkey.txt

Date: Fri, 21 May 1999 14:39:00 GMT From: [email protected] Chris Cowley Subject: Vulnerability in Windows SSL server and common browsers Some time ago, I downloaded a trial version of an SSL web server product for Windows NT called 'Alibaba 2.0' for evaluation as a possible SSL solution. I...

Security Update For Exchange Server 2016 CU12 (KB4509409)

The security update addresses 3 vulnerabilities: An information disclosure vulnerability exists when Microsoft Exchange Server allows creation of entities with Display Names having non-printable characters. An elevation of privilege vulnerability when an attacker executes a man-in-the-middle atta...