CloudBees Jenkins CSRF Mechanism Bypass Vulnerability

CloudBees Jenkins is the open source continuous integration server. CloudBees Jenkins 1.638, LTS 1.625.2 before the version , the use of public salt to generate CSRF protection tokens , remote attackers through brute-force attacks can bypass the CSRF protection mechanism...

CVE-2015-5318

Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack...

Cross site request forgery (csrf)

Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack...

IBM System Networking Switch Center DB Service Remote Elevation of Privilege Vulnerability

This vulnerability allows remote attackers to disclose information on vulnerable installations of IBM System Networking Switch Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IBM SNSC DB Service, that listens by default on port 40999. This...

FreeBSD : Salt -- multiple vulnerabilities (3934cc60-f0fa-4eca-be09-c8bd7ae42871)

Salt release notes : CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log Updated the Git state and execution modules to no longer display HTTPS basic authentication credentials in loglevel debug output on the Salt master. These credentials are now replaced with REDACTED in the...

Salt -- multiple vulnerabilities

Salt release notes: CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log Updated the Git state and execution modules to no longer display HTTPS basic authentication credentials in loglevel debug output on the Salt master. These credentials are now replaced with REDACTED in the...

CVE-2015-5288

The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service server crash or read arbitrary server memory via a "too-short" salt...

UBUNTU-CVE-2015-5288

The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service server crash or read arbitrary server memory via a "too-short" salt...

From django SECRET_KEY to code execution-vulnerability warning-the black bar safety net

A recent review of the code found in some products in the logon of JS code in the leaked SECRETKEY,the value as the password to encrypt the salt, thus exposing the encryption salt is not good., more important is the django security caused great threat. 0x01 SECRETKEY role SECTETKEY in djanog used...

vBulletin 3.6.0 4.2.3 - ForumRunner SQL Injection

vBulletin 3.6.0 4.2.3 - ForumRunner SQL Injection Exploit Title : vBulletin = 4.2.3 SQL Injection CVE-2016-6195 Author : Manish Kishan Tanwar AKA error1046 https://twitter.com/IndiShell1046 Date : 25/08/2015 Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Jagriti,Kishan Singh and ritu...

Fedora 21 : ecryptfs-utils-106-1.fc21 (2015-10581)

Fixes salt usage for password wrapping Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Sql injection

SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie...

CVE-2015-4129

CVE-2015-4129 is a SQL injection vulnerability in Subrion CMS prior to 3.3.3. The issue arises from processing modified serialized data in a salt cookie, allowing remote authenticated users to execute arbitrary SQL commands. Affected software: Subrion CMS; vulnerable component: cookie serializati...

CVE-2015-4129

SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie...

Subrion CMS 'salt' SQL Injection Vulnerability

Subrion CMS is an open source content management system CMS. A SQL injection vulnerability exists in Subrion CMS. An attacker could exploit this vulnerability to take control of the application and access or modify data...

FreeBSD : py-salt -- potential shell injection vulnerabilities (865863af-fb5e-11e4-8fda-002590263bf5)

Colton Myers reports : In order to fix potential shell injection vulnerabilities in salt modules, a change has been made to the various cmd module functions. These functions now default to pythonshell=False, which means that the commands will not be sent to an actual shell. The largest side effec...

SaltStack Insecure Temporary File Vulnerability

SaltStack is an open source set of tools for managing infrastructure. SaltStack has a security vulnerability due to the serverdensitydevice.py module creating the 'install.sh' temporary file in an incorrect way. This allows an attacker to perform arbitrary file operations via symbolic links...

SS-2016-008: Password encryption salt expiry

More info at https://www.silverstripe.org/download/security-releases/ss-2016-008/...

eCryptfs Information Disclosure Vulnerability

eCryptfs Enterprise Cryptographic Filesystem is a set of disk encryption software for encrypted Linux systems maintained by software developers Dustin Kirkland and Tyler Hicks. A security vulnerability exists in eCryptfs 104 and earlier versions, which stems from the use of a default 'salt' value...

ecryptfs-utils: hard-coded passphrase salt

eCryptfs uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack. By default, the wrapping key is hashed with the default fixed salt 0x0011223344556677. This update introduces the version 2 wrapped-passphrase file...