Multiple Flaws Exposed in Pocket Add-on for Firefox

With providing easy accessibility, the battle is not won! Server-side Vulnerabilities have been reported by a security researcher in the popular Pocket add-on that comes attached with the Firefox browser. The security flaws could have allowed hackers to exfiltrate data from the company’s servers ...

crypto++: private key recovery

Evgeny Sidorov discovered that it is possible to recover the private key when using Rabin-Williams signatures due to a bad interaction with the blinding value used to mask private key operations. The bad interaction had to do with the random value not meeting certain Jacobi requirements, which...

Cisco Unified Computing System C Integrated Management Controller Security Bypass Vulnerability

Cisco Unified Computing System UCS C server is a Unified Computing System UCS C-series server from Cisco USA.Integrated Management Controller IMC is a set of management tools used in which it supports HTTP, SSH access, and so on, and can perform operations such as powering on, powering off, and...

[SECURITY] [DSA 3296-1] libcrypto++ security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3296-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini June 29, 2015 https://www.debian.org/security/faq -...

Ceragon FiberAir IP-10 Private Key Vulnerability

The Ceragon FiberAir IP-10 is a wireless microwave transmission device from Ceragon Israel. The Ceragon FiberAir IP-10 SSH private key disclosure vulnerability allows remote attackers to exploit the vulnerability to gain unauthorized access to the device...

Libcrypt++ Private Key Disclosure Vulnerability

libcrypt is an ANSI C encryption library. A private key disclosure vulnerability exists in libcrypt++, which allows remote attackers to obtain a private key via a timing attack...

CVE-2015-2141

The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack...

UBUNTU-CVE-2015-2141

The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack...

[SECURITY] [DLA 262-1] libcrypto++ security update

Package : libcrypto++ Version : 5.6.0-6+deb6u1 CVE ID : CVE-2015-2141 Evgeny Sidorov discovered that libcrypto++, a general purpose C++ cryptographic library, did not properly implement blinding to mask private key operations for the Rabin-Williams digital signature algorithm. This could allow...

DLA-262-1 libcrypto++ - security update

Bulletin has no description...

Debian DSA-3296-1 : libcrypto++ - security update

Evgeny Sidorov discovered that libcrypto++, a general purpose C++ cryptographic library, did not properly implement blinding to mask private key operations for the Rabin-Williams digital signature algorithm. This could allow remote attackers to mount a timing attack and retrieve the user's privat...

DSA-3296-1 libcrypto++ - security update

Bulletin has no description...

Cisco SSH Key Flaw Has Echoes of Earlier Vulnerabilities

When Cisco released a patch for several of its security appliances Thursday that eliminated the presence of hard-coded SSH host and private keys, the advisory had a distinct air of familiarity about it. That’s because the company released a patch for the same problem in one of its other major...

GitHub accounts hacked: old vulnerability leads to a weak key a large number of retention-vulnerability and early warning-the black bar safety net

See also history of the causes of security risks Seven years ago the developer found the GitHub there is a catastrophic vulnerability after GitHub has closed a number of unidentified by key to access the account. Github allows authorized users to login to affiliated with Spotify, Yandex, and the ...

PuTTY Saved Sessions Enumeration Module

This module will identify whether Pageant PuTTY Agent is running and obtain saved session information from the registry. PuTTY is very configurable; some users may have configured saved sessions which could include a username, private key file to use when authenticating, host name etc. If a priva...

NetNanny Found Using Shared Private Key, Root CA

An issue with the content-control software NetNanny could open users’ systems up to man-in-the-middle MiTM attacks, HTTPS spoofing and intercept, researchers warned Monday. First released in 1995, the internet filtering service is primarily used by parents to control their children’s online...

NetNanny uses a shared private key and root CA

Overview NetNanny uses a shared private key and root Certificate Authority CA, making systems broadly vulnerable to HTTPS spoofing. Description NetNanny installs a Man-in-the-Middle MITM proxy as well as a new trusted root CA certificate. The certificate used by NetNanny is shared among all...

Ceragon FibeAir IP-10 SSH Private Key Exposure Exploit

This Metasploit module exploits the fact that Ceragon ships a public/private key pair on FibeAir IP-10 devices that allows passwordless authentication to any other IP-10 device. Since the key is easily retrievable, an attacker can use it to gain unauthorized remote access as the "mateidu" user...

Ceragon FibeAir IP-10 SSH Private Key Exposure

Ceragon FibeAir IP-10 SSH Private Key Exposure CVE-2015-0936 Product Description Ceragon produces a series of ruggedized, microwave backhaul devices used to provide connectivity to mobile, IP-based devices; usually, these devices are found in either large industrial environments, or installed on...

Ceragon FibeAir IP-10 SSH Private Key Exposure

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'net/ssh' class Metasploit3 'Ceragon FibeAir IP-10 SSH Private Key Exposure', 'Description' = %q Ceragon ships a public/private key pair on...