PT-2018-2116

Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 2.14.1 Mbed TLS versions prior to 2.7.8 Mbed TLS versions prior to 2.1.17 Description The issue is related to a local synchronization problem during RSA decryption in Mbed TLS, allowing a local unprivileged attacker ...

Epiphany Healthcare Cardio Server SQL and LDAP Injection Vulnerabilities

Epiphany Healthcare Cardio Server is a scalable ECG management system from Epiphany Healthcare, UK. A security vulnerability exists in Epiphany Healthcare Cardio Server versions prior to 4.0. A local attacker can exploit this vulnerability by inserting an LDAP query into the URL of a login page t...

Security Advisory - Plaintext User Password Vulnerability in VCN500 Logs

Huawei VCN500 Video Cloud Node logs user passwords in plaintext for specific operations on the certain interface, leading to user password leakage. Vulnerability ID：HWPSIRT-2015-09032 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2015-8335. Huawei has...

Radancy: RC4 cipher suites detected

A group of researchers Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering and Jacob Schuldt have found new attacks against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used. The attacks arise from statistical fla...

EMC VPLEX GeoSynchrony Local Information Disclosure Vulnerability

EMC VPLEX is a set of next-generation data storage platforms for moving and accessing information within, across and between data centers; GeoSynchrony is a VPLEX operating system. EMC VPLEX GeoSynchrony is configured by default to store plaintext NAVISPHERE GUI passwords in log files, which can ...

Password disclosure vulnerability attached to multiple IBM products

IBM Tivoli Storage Manager TSM for Databases: Data Protection for Microsoft SQL Server, etc. are products of IBM Corporation in the U.S. IBM TSM for Databases aka Spectrum Protect for Databases is a backup and recovery management solution that runs on databases. IBM TSM for Databases a.k.a...

DLA-342-1 openafs - security update

Bulletin has no description...

Slack: RC4 cipher suites detected on status.slack.com

A group of researchers Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering and Jacob Schuldt have found new attacks against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used. The attacks arise from statistical fla...

IBM InfoSphere BigInsights Uses Apache Ambari Information Disclosure Vulnerability

IBM InfoSphere BigInsights is a suite of software platforms for storing and analyzing "Big Data" from IBM, USA. The platform provides solutions for managing and analyzing massive amounts of structured and unstructured data.Apache Ambari is a set of tools for configuring, managing, and monitoring...

CVE-2015-7412

The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attac...

DSA-3387-1 openafs - security update

Bulletin has no description...

CVE-2000-1199

PostgreSQL stores usernames and passwords in plaintext in 1 pgshadow and 2 pgpwd, which allows attackers with sufficient privileges to gain access to databases...

Web Hosting Service 000webhost Hacked, Information of 13 Million Leaked

Information on nearly 14 million users of 000webhost, a Lithuanian web hosting service, was spilled earlier this year when a hacker exploited an old version of the company’s website and gained access to the backend. 13.5 million customer usernames, plaintext passwords, email addresses, IP...

Biggest Free Hosting Company Hacked; 13.5 Million Plaintext Passwords Leaked

The world’s most popular Free Web Hosting company 000Webhost has suffered a major data breach, exposing more than 13.5 Million of its customers' personal records. The stolen data includes usernames, passwords in plain text, email addresses, IP addresses and last names of around 13.5 Million of...

Apache HTTP Server 2.4.x < 2.4.16 Multiple Vulnerabilities

Binary data 8970.prm...

SSH Diffie-Hellman Modulus <= 1024 Bits (Logjam)

The remote SSH server allows connections with one or more Diffie-Hellman moduli less than or equal to 1024 bits. Through cryptanalysis, a third party can find the shared secret in a short amount of time depending on modulus size and attacker resources. This allows an attacker to recover the...

EMC RSA Archer GRC Sensitive Information Disclosure Vulnerability

EMC RSA Archer GRC is an enterprise IT governance and compliance governance product. EMC RSA Archer GRC uses plaintext to store passwords, allowing remote attackers to access sensitive information by reading database fields...

Gentoo Security Advisory GLSA 201401-03

Gentoo Linux Local Security Checks GLSA 201401-03 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

F5 Networks BIG-IP : SSL/TLS RC4 vulnerability (K16864) (Bar Mitzvah)

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

F5 BIG-IP - SSL/TLS RC4 vulnerability CVE-2015-2808

The remote host is missing a security patch. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if description...