WeBid 1.1.2P2 SQL Injection

Advisory ID: HTB23292 Product: WeBid Vendor: WeBid Vulnerable Versions: 1.1.2P2 and probably prior Tested Version: 1.1.2P2 Advisory Publication: January 22, 2016 without technical details Vendor Notification: January 22, 2016 Vendor Patch: February 4, 2016 Public Disclosure: February 17, 2016...

squid -- SSL/TLS processing remote DoS

Squid security advisory 2016:1 reports: Due to incorrectly handling server errors Squid is vulnerable to a denial of service attack when connecting to TLS or SSL servers. This problem allows any trusted client to perform a denial of service attack on the Squid service regardless of whether TLS or...

Debian Security Advisory DSA 3468-1 (polarssl - security update)

It was discovered that polarssl, a library providing SSL and TLS support, contained two heap-based buffer overflows that could allow a remote attacker to trigger denial of service via application crash or arbitrary code execution. OpenVAS Vulnerability Test $Id: deb3468.nasl 6608 2017-07-07...

Security update for the MozillaFirefox, mozilla-nss and mozilla-nspr (important)

This update to MozillaFirefox fixes several security issues and bugs. Mozilla Firefox was updated to 44.0. Mozilla NSS was updated to 3.21 Mozilla NSPR was updated to 4.11. The following vulnerabilities were fixed: CVE-2016-1930/CVE-2016-1931: Miscellaneous memory safety hazards boo963633...

OpenSSL Multiple MitM Attack Vulnerabilities - Windows

OpenSSL is prone to multiple man-in-the-middle MitM attack vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

OpenSSL Multiple MitM Attack Vulnerabilities - Linux

OpenSSL is prone to multiple man-in-the-middle MitM attack vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Multiple Vulnerabilities in OpenSSL (January 2016) Affecting Cisco Products

On January 28, 2016, the OpenSSL Project released a security advisory detailing two vulnerabilities. Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to conduct man-in-the-middle attac...

lib32-openssl: man-in-the-middle

CVE-2015-3197 man-in-the-middle A flaw was found in the way malicious SSL/TLS clients could negotiate SSLv2 ciphers that have been disabled on the server. This could result in weak SSLv2 ciphers being used for SSL/TLS connections, making them vulnerable to man-in-the-middle attacks. -...

PT-2016-1367

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2 through 1.0.2e Description The issue is related to the DH check pub key function in the crypto/dh/dh check.c file, which does not ensure that prime numbers are appropriate for Diffie-Hellman DH key exchange. This makes i...

Oracle Secure Global Desktop Multiple Vulnerabilities (January 2016 CPU) (Logjam)

The version of Oracle Secure Global Desktop installed on the remote host is version 4.63 / 4.71 / 5.2 and is missing a security patch from the January 2016 Critical Patch Update CPU. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the bundled version of Apache HTT...

[SECURITY] Fedora 22 Update: mbedtls-1.3.16-1.fc22

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

[SECURITY] Fedora 23 Update: mbedtls-2.2.1-1.fc23

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

IBM DB2 10.5 < Fix Pack 7 Multiple Vulnerabilities (Linux) (Bar Mitzvah) (FREAK) (Logjam)

According to its version, the installation of IBM DB2 10.5 running on the remote host is prior to Fix Pack 7. It is, therefore, affected by the following vulnerabilities : - A security feature bypass vulnerability, known as FREAK Factoring attack on RSA-EXPORT Keys, exists due to the support of...

SUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2015:2342-1)

This update for compat-openssl098 fixes the following issues : Security issue fixed:; - CVE-2015-3195: When presented with a malformed X509ATTRIBUTE structure OpenSSL would leak memory. This structure is used by the PKCS7 and CMS routines so any application which reads PKCS7 or CMS data from...

Scientific Linux Security Update : openssl on SL6.x i386/x86_64 (20151214)

A NULL pointer derefernce flaw was found in the way OpenSSL verified signatures using the RSA PSS algorithm. A remote attacked could possibly use this flaw to crash a TLS/SSL client using OpenSSL, or a TLS/SSL server using OpenSSL if it enabled client authentication. CVE-2015-3194 A memory leak...

Xboxlive digital certificate private key is compromised, the user or the man in the middle attacks-vulnerability warning-the black bar safety net

! Microsoft confirmedXboxlive. com domain name for the SSL/TLS digital certificate private key has been compromised, by the attacker is used to attempt to launch a MiTM attack, but the private key cannot be used to sign other certificates or code, or fake other domain names. Xboxlive certificate ...

Xerox WorkCentre 77XX Multiple Vulnerabilities (XRX15R) (FREAK) (GHOST)

According to its model number and software version, the remote Xerox WorkCentre 77XX device is affected by multiple vulnerabilities : - A security feature bypass vulnerability, known as FREAK Factoring attack on RSA-EXPORT Keys, exists due to the support of weak EXPORTRSA cipher suites with keys...

Xerox WorkCentre 4260 / 4265 Multiple Vulnerabilities (XRX15AV) (FREAK) (Logjam)

According to its model number and software version, the remote Xerox WorkCentre 4260 / 4265 device is affected by multiple vulnerabilities : - A security feature bypass vulnerability, known as FREAK Factoring attack on RSA-EXPORT Keys, exists due to the support of weak EXPORTRSA cipher suites wit...

Xerox WorkCentre 3550 OpenSSL Multiple Vulnerabilities (XRX15AJ) (FREAK) (POODLE)

According to its model number and software version, the remote Xerox WorkCentre 3550 device is affected by multiple OpenSSL vulnerabilities : - A man-in-the-middle MitM information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles padding bytes when decrypting...

How to Install Let's Encrypt Free SSL Certificate On Your Website

Another Big Milestone – Let's Encrypt is now offering Free HTTPS certificates to everyone. Let's Encrypt has opened to the public, allowing anyone to obtain Free SSL/TLS Secure Socket Layer/Transport Layer Security certificates for their web servers and to set up HTTPS websites in a few simple...