4498 matches found
CVE-2016-3107
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data...
CVE-2016-3107
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data...
CVE-2016-3107
CVE-2016-3107 affects Pulp: the Node certificate private key is stored in a world‑readable file under /etc/pki/pulp/nodes/, enabling local users to access sensitive data. Affected versions: Pulp before 2.8.3. Root cause: insecure file permissions on the node certificate. Impact: potential disclos...
PT-2017-8337 · Pulp · Pulp
Name of the Vulnerable Software and Affected Versions: Pulp versions prior to 2.8.3 Description: The issue concerns a world-readable file containing the private key for the Node certificate, stored in the "/etc/pki/pulp/nodes/" directory. This allows local users to access sensitive data,...
PT-2017-8331
Name of the Vulnerable Software and Affected Versions Pulp versions prior to 2.8.2 Description The issue allows local users to read the generated private key due to a problem in the server/bin/pulp-gen-ca-certificate functionality. Recommendations For versions prior to 2.8.2, update to version...
CVE-2016-3107: Improper Access Control
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data...
CVE-2016-3095: Exposure of Sensitive Information to an Unauthorized Actor
server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key...
Default credentials
Ceragon FibeAir IP-10 have a default SSH public key in the authorizedkeys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key...
CVE-2015-0936
Ceragon FibeAir IP-10 have a default SSH public key in the authorizedkeys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key...
CFME: default certificate used across all installs
CloudForms includes a default SSL/TLS certificate for the web server. This certificate is replaced at install time. However if an attacker were able to man-in-the-middle an administrator while installing the new certificate, the attacker could get a copy of the uploaded private key allowing for...
Western Digital TV Media Player Multiple critical vulnerabilities
Exploit for hardware platform in category web applications title: Multiple critical vulnerabilities product: Western Digital TV Media Player vulnerable version: 1.03.07 fixed version: - CVE number: - impact: Critical homepage: https://www.wdc.com found: 2017-01-17 by: Wan Ikram Office Kuala Lumpu...
Mailcow 0.14 - Cross-Site Request Forgery
Mailcow 0.14 - Cross-Site Request Forgery + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAILCOW-v0.14-CSRF-PASSWORD-RESET-ADD-ADMIN.txt + ISR: ApparitionSec Vendor: ============= mailcow.email mailcow.github.io Produc...
Mailcow 0.14 - Cross-Site Request Forgery Vulnerability
Exploit for php platform in category web applications + Credits: John Page a.k.a hyp3rlinx Vendor: ============= mailcow.email mailcow.github.io Product: =========== The integrated mailcow UI allows administrative work on your mail server instance as well as separated domain administrator and...
Design/Logic Flaw
There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is...
EulerOS 2.0 SP1 : nettle (EulerOS-SA-2016-1061)
According to the versions of the nettle packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Nettle is a cryptographic library that is designed to fit easily in more or less any context: In crypto toolkits for object-oriented languagesC+...
Information Disclosure
github.com/openshift/origin is vulnerable to information disclosure. When a pod is used with the --credentials option is used, a local attacker can get private key information by reading the systemd journal. This is because when the --credential option is enabled, the router credentials are store...
Moxa MXView Security Vulnerability
Moxa MXView is Moxa's network management software for configuring, monitoring and diagnosing network devices in industrial Ethernet networks. A security vulnerability exists in Moxa MXView version 2.8. The vulnerability can be exploited by a remote attacker to read the private key file of the web...
CVE-2016-6489
The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack...
