Denial Of Service (DoS)

nss is vulnerable to denial of service DoS attacks. The vulnerability exists as the secasn1dparseleaf function in Mozilla Network Security Services NSS before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restrict...

Man-in-the-middle Attack

Network Security Services NSS is vulnerable to a man-in-the-middle attack. The attack exists because it fails in handling state transitions for the TLS state machine and skips handshake message, allowing a man-in-the-middle to decrypt all traffic...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS attacks. The vulnerability exists as the CERTDecodeCertPackage function in Mozilla Network Security Services NSS, as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5,...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS attacks. The vulnerability exists as the ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services NSS before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x...

Denial Of Service

Network Security Services NSS is vulnerable to denial of service. It exists due to the regression introduced by the fix for CVE-2013-1620 which does not properly check the data reading are initialized data, leading to a decryption failure and a TLS/SSL server crash...

Solaris 10 (sparc) : 152927-02

JavaSE 8: update 202 patch equivalent to JDK 8u202, 64bit. Date this patch was last updated by Sun : Jan/14/19 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid121179;...

Fedora 28 : kernel / kernel-headers / kernel-tools (2019-337484d88b)

The v4.19.14 stable update contains important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 28 : mingw-nettle (2019-01afc2352f)

Resolves CVE-2018-16869 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security...

Fedora 29 : mingw-nettle (2019-31015766d1)

Resolves CVE-2018-16869 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security...

Fedora 28 : gnutls (2019-24dc022a51)

Security fix for CVE-2018-16868 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2018-075)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 a...

Fedora 28 : krb5 (2019-ac7e19b0c8)

Improve memset hygiene in one location. ---- Fix low-severity CVE-2018-20217 an authenticated user who can obtain a TGT using an older encryption type DES, DES3, or RC4 can cause an assertion failure in the KDC by sending an S4U2Self request. Note that Tenable Network Security has extracted the...

Virtuozzo 7 : readykernel-patch (VZA-2018-088)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - Transforming an IPv6 socket to an IPv4 and then transforming it back to a listening socket could result in a kernel...

Detecting Insecure Cookies with Qualys Web Application Scanning

Cookies are ubiquitous in today's modern web applications. If an attacker can acquire a user's session cookie by exploiting a cross-site scripting XSS vulnerability, by sniffing an unencrypted HTTP connection, or by some other means, then they can potentially hijack a user's valid session...

SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:0049-1) (Spectre)

This update for java-170-openjdk to version 7u201 fixes the following issues : Security issues fixed : CVE-2018-3136: Manifest better support bsc1112142 CVE-2018-3139: Better HTTP Redirection bsc1112143 CVE-2018-3149: Enhance JNDI lookups bsc1112144 CVE-2018-3169: Improve field accesses bsc111214...

CVE-2018-16192

CVE-2018-16192 affects NEC Aterm WF1200CR and Aterm WG1200CR (firmware 1.1.1 and earlier / 1.0.1 and earlier). The connected sources confirm an information disclosure vulnerability exploitable by an attacker on the same network segment, exposing registered device information via unspecified vecto...

CVE-2018-16198

CVE-2018-16198 affects Toshiba Home gateway HEM-GW16A and HEM-GW26A (firmware 1.2.9 and earlier). The issue is described as hidden functionality (CWE-912) that allows an attacker on the same network segment to access a non-documented developer screen and perform operations on the device. NVD note...

CVE-2018-16201

The CVE-2018-16201 issue affects Toshiba Home gateway models HEM-GW16A and HEM-GW26A (firmware 1.2.9 and earlier). It stems from hard-coded credentials, potentially allowing an attacker on the same network segment to log into the administrator settings screen and, from there, change configuration...

SUSE SLES11 Security Update : xen (SUSE-SU-2019:13921-1)

This update for xen fixes the following issues : Security vulnerabilities fixed : CVE-2018-19961, CVE-2018-19962: Fixed an issue related to insufficient TLB flushing with AMD IOMMUs, which potentially allowed a guest to escalate its privileges, may cause a Denial of Service DoS affecting the enti...

SUSE SLED15 / SLES15 Security Update : gpg2 (SUSE-SU-2019:0023-1)

This update for gpg2 fixes the following issue : Security issue fixed : CVE-2018-1000858: Fixed a Cross Site Request ForgeryCSRF vulnerability in dirmngr that can result in Attacker controlled CSRF bsc1120346. Note that Tenable Network Security has extracted the preceding description block direct...