CVE-2013-4218

The InitMethodAndPassword function in InfraStack/OSAgnostic/WiMax/Agents/Supplicant/Source/SupplicantAgent.c in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices uses the same RSA private key in supplicantkey.pem on all systems, which allows local user...

Multiple Vendors EAS Authentication Bypass

The remote EAS device permits root login using an SSH key with a publicly available private key. The private key was included in older copies of Monroe Electronics and Digital Alert Systems firmware. A remote attacker with access to the private key can bypass authentication of the root user...

PuTTY 0.52 to 0.62 Multiple Vulnerabilities

The remote host has an installation of PuTTY version 0.52 or greater but earlier than version 0.63. As such, it is reportedly affected by the following vulnerabilities : - An overflow error exists in the function 'modmul' in the file 'putty/sshbn.c' that could allow heap corruption when handling...

gnupg / libcrypt RSA implementation flush+reload timing attack

Private key recovery by using CPU L3 cache timings...

FreeBSD : PuTTY -- Four security holes in versions before 0.63 (4b448a96-ff73-11e2-b28d-080027ef73ec)

Simon Tatham reports : This 0.63 release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. ... These vulnerabilities can be triggered before host key verification, which means that you are not even saf...

Debian DSA-2730-1 : gnupg - information leak

Yarom and Falkner discovered that RSA secret keys could be leaked via a side channel attack, where a malicious local user could obtain private key information from another user on the system. This update fixes this issue for the 1.4 series of GnuPG. GnuPG 2.x is affected through its use of the...

[SECURITY] [DSA 2730-1] gnupg security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2730-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst July 29, 2013 http://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-2731-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-2730-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PuTTY -- Four security holes in versions before 0.63

Simon Tatham reports: This 0.63 release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. ... These vulnerabilities can be triggered before host key verification, which means that you are not even safe...

Default configuration

The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 contains a known SSH private key, which makes it easier for remote attackers to obtain root access, and spoof alerts, via an SSH session...

CVE-2013-0137

The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 contains a known SSH private key, which makes it easier for remote attackers to obtain root access, and spoof alerts, via an SSH session...

samba -- Private key in key.pem world readable

The Samba project reports: Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesyst...

AMI Firmware Source Code, Private Key Leaked

Source code and a private signing key for firmware manufactured by a popular PC hardware maker American Megatrends Inc. AMI have been found on an open FTP server hosted in Taiwan. Researcher Brandan Wilson found the company’s data hosted on an unnamed vendor’s FTP server. Among the vendor’s...

Verax NMS Hardcoded Private Key (CVE-2013-1352)

Verax NMS Hardcoded Private Key CVE-2013-1352 I. BACKGROUND ---------------------- Verax NMS provides a service-oriented, unified management & monitoring of networks, applications and infrastructure enabling quick problem detection, root-cause analysis, reporting and automating recovery, reducing...

Verax NMS multiple security vulnerabilities

Authentication bypass, replay attacks, hardcoded private key, information leakage...

Verax NMS Hardcoded Private Key

Verax NMS Hardcoded Private Key CVE-2013-1352 I. BACKGROUND ---------------------- Verax NMS provides a service-oriented, unified management & monitoring of networks, applications and infrastructure enabling quick problem detection, root-cause analysis, reporting and automating recovery, reducing...

nss: Dis-trust TURKTRUST mis-issued *.google.com certificate

REJECTED CVE TURKTRUST, a certificate authority in Mozilla’s root program, had mis-issued two intermediate certificates to customers. One of the certificates was used for man-in-the-middle MITM traffic management of domain names that the customer did not legitimately own or control. An intermedia...

CVE-2012-5616

Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform formerly Citrix CloudStack before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain 1 the SSH private key as recorded by the createSSHKeyPair API, 2 the password of an added host as recorde...

Design/Logic Flaw

Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform formerly Citrix CloudStack before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain 1 the SSH private key as recorded by the createSSHKeyPair API, 2 the password of an added host as recorde...