CVE-2015-2774

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 aka POODLE...

CVE-2015-2774

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 aka POODLE...

CVE-2015-2774

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 aka POODLE...

CVE-2015-2774

Technical details for CVE-2015-2774 are not publicly available in the provided connected documents. The materials reference POODLE-related padding oracle (CVE-2014-3566) but do not supply product/version/root-cause/fix information for CVE-2015-2774. Monitor for updates.

otpbank.com.ua Open Redirect vulnerability

Vulnerable URL: http://otpbank.com.ua/bitrix/rk.php?goto=https://www.openbugbounty.org/ Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 23:11 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 141741...

CVE-2015-2774

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 aka POODLE...

CVE-2015-2774: Exposure of Sensitive Information to an Unauthorized Actor

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 aka POODLE...

UBUNTU-CVE-2015-2774

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 aka POODLE...

GitLab: Bypassing password authentication of users that have 2FA enabled

Proof of Concept When a user has 2FA enabled, it's possible to sign in as that user without the need to know its password. To reproduce this attack, you need two users that both have 2FA enabled. For the sake of this PoC, lets call them Jane and John. Jane is the attacker and wants to get access ...

State Bank Secure OTP - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application State Bank Secure OTP published at the 'play' market has multiple vulnerabilities...

otpbank.hu XSS vulnerability

Vulnerable URL: https://www.otpbank.hu/portal/hu/fooldal?lang=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 02.06.2017 Latest check for patch:| 02.06.2017 16:04 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Shopify: Bypassed password authentication before enabling OTP verification

When we enable Two step verification then shopify first ask for password then allow user to set OTP verification. Here i bypassed this password verification. Steps to reproduce the vulnerability. 1.To produce this vulnerability i created two account on shopify . For easy understand let give them...

Medium: krb5

Issue Overview: A flaw was found in the OTP kdcpreauth module of MIT Kerberos. A remote attacker could use this flaw to bypass the requirespreauth flag on a client principal and obtain a ciphertext encrypted in the principal's long-term key. This ciphertext could be used to conduct an off-line...

devise-two-factor 1.1.0 and earlier vulnerable to replay attacks

A OTP replay vulnerability in devise-two-factor 1.1.0 and earlier allows local attackers to shoulder-surf a user's TOTP verification code and use it to login after the user has authenticated. By not "burning" a previously used TOTP, devise-two-factor allows a narrow window of opportunity aka the...

MapLogin: Account creation code bypass

hi Team i was able to make an authentication bypass in your application . Steps to replicate: there are two phase evolved 1 creating account using valid otp sent to registered email id . 2 capture the response it will be like HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cache-Control:...

[SECURITY] Fedora 22 Update: openvas-manager-6.0.3-4.fc22

The OpenVAS Manager is the central service that consolidates plain vulnerab ility scanning into a full vulnerability management solution. The Manager control s the Scanner via OTP and itself offers the XML-based, stateless OpenVAS Manageme nt Protocol OMP. All intelligence is implemented in the...

CVE-2015-2694: Undefined Security Weakness

The kdcpreauth modules in MIT Kerberos 5 aka krb5 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing 1 zero bytes of data or 2 an arbitrary realm name,...

OpenVAS - The World's Most Advanced Open Source Vulnerability Scanner and Manager

The Open Vulnerability Assessment System OpenVAS is a framework of several services and tools. The core of this SSL-secured service-oriented architecture is the OpenVAS Scanner. The scanner very efficiently executes the actual Network Vulnerability Tests NVTs which are served with daily updates v...

Erlang OTP Information Disclosure Vulnerability

Erlang is a general-purpose parallel programming language developed by British software developer Joe Armstrong.OTP is the middleware developed by OTP, an application operating system and a bunch of function libraries for building large, fault-tolerant and distributed applications. An information...

Scientific Linux Security Update : ipa on SL7.x x86_64 (20150305)

Two cross-site scripting XSS flaws were found in jQuery, which impacted the Identity Management web administrative interface, and could allow an authenticated user to inject arbitrary HTML or web script into the interface. CVE-2010-5312, CVE-2012-6662 Note: The IdM version provided by this update...