Directory traversal

Directory Traversal was discovered in University of Cambridge moducamwebauth before 2.0.2. The key identification field "kid" of the IdP's HTTP response message "WLS-Response" can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is...

CVE-2015-9287

Directory Traversal was discovered in University of Cambridge moducamwebauth before 2.0.2. The key identification field "kid" of the IdP's HTTP response message "WLS-Response" can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is...

Fedora Update for gnupg2 FEDORA-2019-75a8da28f0

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : libssh2_org (openSUSE-2019-1290)

This update for libssh2org fixes the following issues : - Incorrect upstream fix for CVE-2019-3859 broke public key authentication bsc1133528, bsc1130103 This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

OPENSUSE-SU-2019:1291-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - Incorrect upstream fix for CVE-2019-3859 broke public key authentication bsc1133528, bsc1130103 This update was imported from the SUSE:SLE-15:Update update project...

SUSE SLED12 / SLES12 Security Update : libssh2_org (SUSE-SU-2019:1060-1)

This update for libssh2org fixes the following issues : - Incorrect upstream fix for CVE-2019-3859 broke public key authentication bsc1133528, bsc1130103 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempte...

SUSE SLES11 Security Update : libssh2_org (SUSE-SU-2019:14031-1)

This update for libssh2org fixes the following issues : Incorrect upstream fix for CVE-2019-3859 broke public key authentication bsc1133528, bsc1130103 Store but don't use keys of unsupported types in the knownhosts file bsc1091236 Note that Tenable Network Security has extracted the preceding...

Security update for libssh2_org (important)

openSUSE Security Update: Security update for libssh2org Announcement ID: openSUSE-SU-2019:1291-1 Rating: important References: 1130103 1133528 Cross-References: CVE-2019-3859 Affected Products: openSUSE Leap 15.0 An update that solves one vulnerability and has one errata is now available...

openSUSE Security Update : libssh2_org (openSUSE-2019-1291)

This update for libssh2org fixes the following issues : - Incorrect upstream fix for CVE-2019-3859 broke public key authentication bsc1133528, bsc1130103 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

SUSE-SU-2019:14032-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - Incorrect upstream fix for CVE-2019-3859 broke public key authentication bsc1133528, bsc1130103...

SUSE-SU-2019:1060-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - Incorrect upstream fix for CVE-2019-3859 broke public key authentication bsc1133528, bsc1130103...

SUSE-SU-2019:1059-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - Incorrect upstream fix for CVE-2019-3859 broke public key authentication bsc1133528, bsc1130103...

SUSE-SU-2019:14031-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - Incorrect upstream fix for CVE-2019-3859 broke public key authentication bsc1133528, bsc1130103 - Store but don't use keys of unsupported types in the knownhosts file bsc1091236...

Omise: Public and secret api key leaked via omise github repo(owned by omise)

Found secret key of particular omise accounts! Functionality of the public and secret keys are described below: Public key The public key can be used to create tokens via javascript from your customers browsers. This key can be safely exposed to the outside world. Secret key The secret key can be...

IBM Content Navigator Information Disclosure Vulnerability

IBM Content Navigator is a Web client from IBM USA. The product supports searching and processing documents stored in content servers from a Web browser. A security vulnerability exists in IBM Content Navigator version 2.0.3 and 3.0CD, which originates from the program's use of a public key store...

The vulnerability of Nettle’s cryptographic library is related to an error in the reverse transformation of decrypted RSA data, which allows attackers to gain access to the protected information.

The vulnerability of the Nettle cryptographic library is related to an error in the reverse transformation of decrypted RSA data. Exploiting this vulnerability could allow an attacker to gain access to protected information through a secondary channel...

JamieWeb: Security headers missed on https://acme-validation.jamieweb.net/

Summary: Hi JamieWeb team, the https://acme-validation.jamieweb.net/ domain doesn't present some important security headers. The X-DNS-Prefetch-Control header isn't specified with value off, so is enabled b default on modern web browsers, and can lead to information disclosure...

PuTTY (European Commission - DIGIT): puttygen: heap-buffer-overflow in mp_get_decimal()

Summary: After downloading putty-0.70-2019-01-17.53747ad.tar.gz, I compiled it on Debian 9 with Clang-8.0.0 and AddressSanitizer and while trying to extract a public key from a crafted key file, I triggered a heap-buffer-overflow in mpgetdecimal. Description: A buffer overflow condition exists wh...

PuTTY (European Commission - DIGIT): heap-use-after-free (READ of size 8) in main()

Summary: After downloading putty-0.70-2019-01-17.53747ad.tar.gz, I compiled it on Debian 9 with Clang-8.0.0 and AddressSanitizer and while trying to extract a public key from a crafted key, I triggered a heap-use-after-free in main. Description: add more details about this vulnerability Steps To...

pyOpenSSL: Failure to release memory before removing last reference in PKCS #12 Store

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS 12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends...