Security Bulletin: Vulnerabilities in NTP affect IBM Flex System Chassis Management Module

Summary IBM Flex System Chassis Management Module CMM has addressed the following vulnerabilities in NTP. Vulnerability Details Summary IBM Flex System Chassis Management Module CMM has addressed the following vulnerabilities in NTP. Vulnerability Details CVE-ID: CVE-2015-7973 Description: NTP...

CVE-2018-19023

CVE-2018-19023 affects Hetronic Nova-M transmitters (prior to firmware r161) with fixed codes that can be sniffed and replayed to control receivers. ZDI-ZDI-19-003-03 details remote command replay via capture-replay without authentication; impact includes unauthorized command execution and device...

Replay Attack

tendrl-api is vulnerable to replay attack. The server does not invalidate session tokens immediately when a user logs out of the application. This allows an attacker, who has obtained a user's session tokens via sniffing/MitM attack, to re-use or replay a user's session token or request to gain...

Ubuntu: Security Advisory (USN-3850-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : NSS vulnerabilities (USN-3850-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3850-1 advisory. Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perfo...

USN-3850-1: NSS vulnerabilities

Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perform a cache-timing attack and recover private ECDSA keys. CVE-2018-0495 It was discovered that NSS incorrectly handled certain v2-compatible ClientHello messages. A remo...

PT-2019-9715

Name of the Vulnerable Software and Affected Versions Hetronic Nova-M versions prior to r161 Description The issue allows for unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state due to the use of fixed codes that can be...

Hetronic Nova-M Replay Attack Vulnerability

This vulnerability allows remote attackers to issue commands on vulnerable installations of Hetronic equipment. Authentication is not required to exploit this vulnerability. The specific flaw exists with the communication between the transmitter and receiver pair. By using a fixed control code an...

MGASA-2018-0487 Updated kernel packages fix security vulnerabilities

This kernel update is based on the upstream 4.14.89 and fixes at least the following security issues: Cross-hyperthread Spectre v2 mitigation is now provided by the Single Thread Indirect Branch Predictors STIBP support. Note that STIBP also requires the functionality be supported by the Intel...

Updated kernel packages fix security vulnerabilities

This kernel update is based on the upstream 4.14.89 and fixes at least the following security issues: Cross-hyperthread Spectre v2 mitigation is now provided by the Single Thread Indirect Branch Predictors STIBP support. Note that STIBP also requires the functionality be supported by the Intel...

GHSA-GF2J-7QWG-4F5X Improper Authentication in Keycloak

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack...

Red Hat keycloak denial of service vulnerability

Red Hat keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in the SAML broker consumer endpoint in versions prior to Red Hat keycloak 4.6.0.Final, which stems from a...

CVE-2018-14637

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack...

Design/Logic Flaw

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack...

CVE-2018-14637

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack...

CVE-2018-14637

The vulnerability CVE-2018-14637 affects Keycloak prior to 4.6.0.Final, where the SAML broker consumer endpoint ignores expiration checks on SAML assertions. This enables replay attacks against requests authenticated via SAML assertions. Connected advisories (GHSA-GF2J-7QWG-4F5X and related OSV/C...

CVE-2018-14637

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack...

CVE-2018-14637

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack...

CVE-2018-14637: Improper Authentication

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack...

PT-2018-12632

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 4.6.0.Final Description The issue concerns the SAML broker consumer endpoint in Keycloak, which ignores expiration conditions on SAML assertions. This can be exploited by an attacker to perform a replay attack...