Design/Logic Flaw

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity...

CVE-2018-1000071

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity...

CVE-2018-1000071

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity...

CVE-2018-1000071

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity...

CVE-2018-1000071

Roundcube Webmail

CVE-2018-1000071

roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity...

CVE-2018-1000104

A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured keystore and priva...

CVE-2018-1000104

A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured keystore and priva...

PT-2018-9257

Name of the Vulnerable Software and Affected Versions: roundcube versions 1.3.4 and earlier Description: The issue concerns a problem with insecure permissions in the enigma plugin, which can lead to the exfiltration of the gpg private key. This can be exploited through network connectivity...

MyCrypto: Html injection mycrypto.com

Hello. I remembered that a couple of months ago I found an HTML injection vulnerability on myetherwallet.com, I sent it, but my message was ignored. Since you have the same interface, I decided to check this vulnerability on your site and it was reproduced. The vulnerability works both on...

DEBIAN-CVE-2018-7170

ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an...

UBUNTU-CVE-2018-7170

ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an...

Authentication flaw

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-5189

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-5189

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-5189 private SSL key embedded in JAR file in iManager

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-5189

CVE-2017-5189 affects NetIQ iManager prior to 3.0.3, where a SSL private key was embedded in a Java application (JAR) used to authenticate to the Sentinel appliance. This flaw enables an attacker to extract the private key and establish their own connections to Sentinel. The available sources des...

pulp: Leakage of CA key in pulp-qpid-ssl-cfg

It was found that the private CA key was created in a directory that is world-readable for a small amount of time. A local user could possibly use this flaw to gain access to the private key information in the file...

Denial Of Service (DoS)

crypto/dsa in github.com/golang/go is vulnerable to denial of service DoS attacks. It is possible to cause an infinite loop by providing a DSA private key that is unable to produce a valid signature in the Sign function...

[ASA-201801-11] qtpass: private key recovery

Arch Linux Security Advisory ASA-201801-11 ========================================== Severity: High Date : 2018-01-11 CVE-ID : CVE-2017-18021 Package : qtpass Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-576 Summary ======= The package qtpass before version...