openSUSE Security Update : gnutls (openSUSE-2012-121)

Fix GnuTLS DTLS plaintext recovery attack %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-121. The text description of this plugin is C SUSE LLC. include'deprecatednasllevel.inc'...

openSUSE Security Update : libopenssl-devel (openSUSE-SU-2012:0083-1)

Various security vulnerabilities have been fixed in openssl : - DTLS plaintext recovery attack CVE-2011-4108 - uninitialized SSL 3.0 padding CVE-2011-4576 - malformed RFC 3779 data can cause assertion failures CVE-2011-4577 - SGC restart DoS attack CVE-2011-4619 - invalid GOST parameters DoS atta...

openSUSE Security Update : nss-201112 (openSUSE-SU-2012:0030-1) (BEAST)

The Mozilla NSS libraries were updated to version 3.13.1 to fix various bugs and security problems. Following security issues were fixed: dbg114-nss-201112-5564 newupdateinfo nss-201112-5564 SSL 2.0 is disabled by default dbg114-nss-201112-5564 newupdateinfo nss-201112-5564 A defense against the...

openSUSE Security Update : openssl (openSUSE-2012-52)

openssl was prone to several security issues : - DTLS Plaintext Recovery Attack CVE-2011-4108 - Uninitialized SSL 3.0 Padding CVE-2011-4576 - Malformed RFC 3779 Data Can Cause Assertion Failures CVE-2011-4577 - SGC Restart DoS Attack CVE-2011-4619 - Invalid GOST parameters DoS Attack CVE-2012-002...

openSUSE Security Update : mozilla-nss (openSUSE-2011-100) (BEAST)

Added a patch to fix errors in the pkcs11n.h header file. bmo702090 - update to 3.13.1 RTM - better SHA-224 support bmo647706 - fixed a regression causing hangs in some situations introduced in 3.13 bmo693228 - update to 3.13.0 RTM - SSL 2.0 is disabled by default - A defense against the SSL 3.0...

openSUSE Security Update : openssl (openSUSE-SU-2013:0337-1)

openssl was updated to 1.0.1e, fixing bugs and security issues : o Fix renegotiation in TLS 1.1, 1.2 by using the correct TLS version. o Include the fips configuration module. o Fix OCSP bad key DoS attack CVE-2013-0166 bnc802746 o Fix for SSL/TLS/DTLS CBC plaintext recovery attack CVE-2013-0169...

Crowd User Directory application password stored in plain text

Table: cwddirectoryattribute Column: attributevalue How to Verify in my environment: Connect to JIRA database using psql and run query: code select attributevalue from cwddirectoryattribute where attributename = 'application.password' code Note how the returned value is the plain text value of th...

NetGear DGN2200 N300无线路由器多个漏洞

Title: Multiple vulnerabilities in NETGEAR N300 WIRELESS ADSL2+ MODEM ROUTER DGN2200 ==================================================================================== Notification Date: 11 February 2014 Affected Vendor: NetGear Affected Hardware: NetGear DGN2200 N300 Wireless ADSL2+ Modem Rout...

BTC China operations improper random user plaintext password leak-vulnerability warning-the black bar safety net

OpenSSL“heartbleed”vulnerability https://vip.btcchina.com ! !...

eBay Password Database Hack Raises Questions

As is the case with most high-profile data breaches, despite an initial disclosure of information, more questions are inevitable. The eBay password database hack is a prime example. Inquiring minds still want to know more about how the stolen passwords are secured and why the online auction house...

CVE-2013-7385

LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which allows remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an...

CVE-2013-6806

OpenText Exceed OnDemand EoD 8 allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via a crafted string in a response, which triggers a downgrade to simple authentication that sends credentials in plaintext...

CVE-2013-7033

LiveZilla before 5.1.2.1 includes the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which might allow remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent...

Cross site scripting

LiveZilla before 5.1.2.1 includes the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which might allow remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent...

Authentication flaw

OpenText Exceed OnDemand EoD 8 allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via a crafted string in a response, which triggers a downgrade to simple authentication that sends credentials in plaintext...

CVE-2013-7385

Technical details about this CVE are not publicly available in the provided Connected documents. Monitor for updates.

CVE-2013-6806

The CVE-2013-6806 entry concerns OpenText Exceed OnDemand (EoD) 8. A crafted response string allows a man-in-the-middle to disable bidirectional authentication, triggering a downgrade to simple authentication and sending credentials in plaintext. The vulnerability is network-exploitable with medi...

CVE-2013-7033

CVE-2013-7033 affects LiveZilla prior to 5.1.2.1. The issue arises because the operator password is included in plaintext in Javascript generated by lz/mobile/chat.php, enabling an independent XSS to retrieve loginName and loginPassword and potentially gain privileges. Multiple sources (NVD, Red ...

CVE-2013-7033

LiveZilla before 5.1.2.1 includes the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which might allow remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent...

CVE-2013-7385: Undefined Security Weakness

LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which allows remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an...