Socat Weak Diffie-Hellman Prime Number

Update Socat is the latest open source tool to come under suspicion that it is backdoored. Socat is a versatile command line utility that builds bi-directional communication streams and moves data between channels, including files, network pipes, serial connected devices, sockets or a combination...

FreeBSD : socat -- diffie hellman parameter was not prime (a52a7172-c92e-11e5-96d6-14dae9d210b8)

socat reports : In the OpenSSL address implementation the hard-coded 1024 bit DH p parameter was not prime. The effective cryptographic strength of a key exchange using these parameters was weaker than the one one could get by using a prime p. Moreover, since there is no indication of how these...

socat -- diffie hellman parameter was not prime

socat reports: In the OpenSSL address implementation the hard coded 1024 bit DH p parameter was not prime. The effective cryptographic strength of a key exchange using these parameters was weaker than the one one could get by using a prime p. Moreover, since there is no indication of how these...

OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)

Usual Mandatory Disclaimer: IANAC I am not a cryptographer so I might likely end up writing a bunch of mistakes in this blog post... tl;dr The OpenSSL 1.0.2 releases suffer from a Key Recovery Attack on DH small subgroups. This issue got assigned CVE-2016-0701 with a severity of High and OpenSSL...

CVE-2016-0701

The DHcheckpubkey function in crypto/dh/dhcheck.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman DH key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose...

Cisco Prime Network Services Controller Unauthorized Local Command Execution (cisco-sa-20151217-pnsc)(deprecated)

Nessus has dropped device detection of the now EOL Cisco Prime Network Services Controller. This plugin is being deprecated as a result. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2023/07/05. Deprecated along with dropping SSH library support. include"compat.inc"; if description...

Cisco Prime Infrastructure Cross-Site Scripting Vulnerability

Cisco Prime Infrastructure is a solution for wireless management through Cisco Technologies LMS and NCS. A cross-site scripting vulnerability exists in Cisco Prime Infrastructure. An attacker could exploit this vulnerability to inject arbitrary web script or HTML code...

CVE-2015-6434

Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka Bug ID CSCux64856...

Cross site scripting

Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka Bug ID CSCux64856...

CVE-2015-6434

Cisco Prime Infrastructure is affected by CVE-2015-6434 due to improper restriction of IFRAME elements in its web interface, enabling remote attackers to perform clickjacking via a crafted site. Root cause: insufficient HTML iframe protection (XFS). Impact: client-side browser attacks may be poss...

CVE-2015-6434

Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka Bug ID CSCux64856...

CVE-2015-6434: Improper Neutralization of Input During Web Page Generation

Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka Bug ID CSCux64856...

primesquarecondo.com XSS vulnerability

Vulnerable URL: http://www.primesquarecondo.com/FloorPlan-RoomtypeDetail.php?roomNO=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

What the heck is RFC 5114?

Mandatory Disclaimer: IANAC I am not a cryptographer so I might likely end up writing a bunch of mistakes in this blog post... I already talked about Diffie–Hellman DH from now on in TLS in my previous post: Small subgroup attack in Mozilla NSS. As mentioned FWIW I strongly agree with Google Chro...

Cisco Prime Infrastructure Frame Injection Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. The vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to an...

Cisco Prime Network Services Controller任意命令执行漏洞

No description provided by source...

Cisco Prime Network Services Controller Arbitrary Command Execution Vulnerability

Cisco Prime Network Services Controller is a set of cloud automation network management software from Cisco Cisco. An arbitrary command execution vulnerability exists in Cisco Prime Network Services Controller 3.0. It allows a local user to bypass predefined access restrictions and execute...

CVE-2015-6426

Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command, aka Bug ID CSCus99427...

Command injection

Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command, aka Bug ID CSCus99427...

CVE-2015-6426

Cisco Prime Network Services Controller 3.0 is affected by CVE-2015-6426. A local attacker can bypass access restrictions and execute arbitrary commands by supplying extra parameters to an unspecified local command due to insufficient validation of local commands (Bug CSCus99427). The issue can b...