CVE-2016-1000338

CVE-2016-1000338 affects the Bouncy Castle JCE Provider (version 1.55 and earlier). The DSA signature verification does not fully validate ASN.1 encoding, allowing an attacker to inject extra elements into the signature sequence and still have it validate, potentially introducing invisible data i...

CVE-2016-1000338

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of...

CVE-2016-1000338

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of...

ZenMate VPN Browser Extension Deanonymization & Hijacking Vulnerability (3.5 Million Affected Users)

Summary ZenMate, a VPN provider with over 43 million users, offers multiple browser extensions to use their VPN with. As of the time of this writing the browser extensions have a combined total of 3.5 million users. The ZenMate VPN clients for both Chrome & Firefox trust the previously expired...

Cross-site Scripting (XSS)

simplesamlphp is vulnerable to cross-site scripting XSS attacks. A malicious user can craft URLs that include Javascript to pass to another user for execution through the setConsentText function in the consentAdmin module. This vulnerability requires the consentAdmin module to be enabled and...

Design/Logic Flaw

DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter...

CVE-2018-11404

DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter...

DomainMod cross-site scripting vulnerability (CNVD-2018-10361)

DomainMod is a PHP and MySQL based open source application for managing centrally located domain names and other Internet assets. A cross-site scripting vulnerability exists in DomainMod version 4.09.03. A remote attacker can exploit this vulnerability by sending the 'sslpaid' parameter to the...

Bypassing Signature Validation

simplesamlphp is vulnerable to bypassing signature validation. There is a flaw in signature verification on SAML assertions which allows construction of a crafted SAML assertion on behalf of an Identity Provider. Consequently, an attacker can impersonate a user from that Identity Provider...

Modern Bank Heists: Cybersecurity Threats Facing the Financial Sector

Despite investing heavily in security, financial institutions continue to experience cyber attacks at a rapid pace. Conducted primarily for the purpose of yielding illicit financial gain, cyber attacks against the financial services industry are increasing in sophistication and are often...

ovirt-ansible-roles: passwords revealed in ansible log when provisioning new provider

Due to a missing nolog directive, the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosed admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation...

CVE-2018-1117

Due to a missing nolog directive, the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosed admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation...

Microsoft Windows Multiple Vulnerabilities (KB4103716)

This host is missing a critical security update according to Microsoft KB4103716 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB4103725)

This host is missing a critical security update according to Microsoft KB4103725 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Updates for Windows Server 2008 (May 2018)

The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the Credential Security Support Provider protocol CredSSP. An attacker who successfully exploits this vulnerability could relay user...

How To Deploy NetScaler as Both OAuth SP and IdP

Deploying the NetScaler, as both an OAuth Service Provider SP and IdP Identity Provider or OpenID Authenticator. This can be on the same NetScaler, or on two separate appliances...

Antivirus Exclusions for Veeam Service Provider Console

Purpose This article documents antivirus exclusions that may be created to reduce the impact that antivirus software has on the functionality of Veeam Service Provider Console. These antivirus exclusions may be applied to the Windows built-in antivirus or third-party antivirus software. Note:...

Cisco Multiple Product Session Fixation Vulnerability

Cisco 3000 Series Industrial Security Appliances ISA are different series of security firewall appliances from Cisco.AnyConnect Secure Mobility Client, Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software are the software used in them.AnyConnect Secure Mobility Clien...

Microsoft Windows: Turn off Windows Location Provider

This policy setting turns off the Windows Location Provider feature. If enabled, the Windows Location Provider feature is turned off, and programs are not able to use the Windows Location Provider feature. OpenVAS Vulnerability Test $Id: winlocationprovider.nasl 11363 2018-09-12 13:46:05Z emoss $...

Session fixation

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...