Jenkins Remote Code Execution Vulnerability (Nov 2014) - Linux

Jenkins is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:jenkins:jenkins";...

MileSight camera default private key certificate vulnerability

MileSight camera is a network camera produced by Xiamen PulseVision Digital Technology Co. MileSight camera suffers from a default private key certificate vulnerability. Since all cameras share the same secret key, an attacker can exploit the vulnerability to launch a man-in-the-middle attack whe...

UBUNTU-CVE-2015-5303

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

PYSEC-2016-35

The TripleO Heat templates tripleo-heat-templates, when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter...

PT-2017-8013

Name of the Vulnerable Software and Affected Versions Socat versions 1.7.3.0 through 2.0.0-b8 Description The issue lies in the OpenSSL address implementation, which does not utilize a prime number for the Diffie-Hellman DH key exchange. This oversight makes it easier for remote attackers to obta...

FreeBSD-SA-16:06.bsnmpd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-16:06.bsnmpd Security Advisory The FreeBSD Project Topic: Insecure default snmpd.config permissions Category: contrib Module: bsnmpd Announced: 2016-01-14...

FreeBSD -- Insecure default snmpd.config permissions

Problem Description: The SNMP protocol supports an authentication model called USM, which relies on a shared secret. The default permission of the snmpd configuration file, /etc/snmpd.config, is weak and does not provide adequate protection against local unprivileged users. Impact: A local user m...

python-rdomanager-oscplugin: NeutronMetadataProxySharedSecret parameter uses default value

It was discovered that Director's NeutronMetadataProxySharedSecret parameter remained specified at the default value of 'unset'. This value is used by OpenStack Networking to sign instance headers; if unchanged, an attacker knowing the shared secret could use this flaw to spoof OpenStack Networki...

Jenkins Remote Code Execution Vulnerability (Nov 2014) - Windows

Jenkins is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:jenkins:jenkins";...

CVE-2015-5320

Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave...

EMC RSA Certificate Manager and RSA Registration Manager Cross-Site Scripting Vulnerability (CNVD-2015-01665)

EMC RSA Certificate Manager RCM and RSA Registration Manager RRM are both products of EMC Corporation, RCM is a digital certificate management system that provides automated implementation of encryption key and digital certificate management, and RRM is a certificate registration management syste...

Cross site scripting

Cross-site scripting XSS vulnerability in EMC RSA Certificate Manager RCM before 6.9 build 558 and RSA Registration Manager RRM before 6.9 build 558 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the CMP shared secret parameter...

CVE-2015-0521

Cross-site scripting XSS vulnerability in EMC RSA Certificate Manager RCM before 6.9 build 558 and RSA Registration Manager RRM before 6.9 build 558 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the CMP shared secret parameter...

CVE-2015-0521

Cross-site scripting XSS vulnerability in EMC RSA Certificate Manager RCM before 6.9 build 558 and RSA Registration Manager RRM before 6.9 build 558 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the CMP shared secret parameter...

CVE-2015-0521

CVE-2015-0521 is a stored XSS vulnerability affecting EMC RSA Certificate Manager (RCM) and RSA Registration Manager (RRM) prior to 6.9 Build 558. The issue involves the CMP shared secret parameter and can be exploited by remote authenticated users to inject arbitrary HTML/script in a user’s brow...

CVE-2015-0521: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in EMC RSA Certificate Manager RCM before 6.9 build 558 and RSA Registration Manager RRM before 6.9 build 558 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the CMP shared secret parameter...

PT-2015-4685

Name of the Vulnerable Software and Affected Versions EMC RSA Certificate Manager versions prior to 6.9 build 558 EMC RSA Registration Manager versions prior to 6.9 build 558 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via...

PT-2015-4972

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator ePO versions prior to 4.6.9 McAfee ePolicy Orchestrator ePO versions 5.x prior to 5.1.2 Description The issue allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password, ...

CVE-2015-0922: Exposure of Sensitive Information to an Unauthorized Actor

McAfee ePolicy Orchestrator ePO before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password...

IKE Aggressive Mode Shared Secret Hash Leakage Weakness

No description provided by source. source: http://www.securityfocus.com/bid/7423/info When a VPN is configured to use a pre-shared master secret and a client attempts to negotiate keys in aggressive mode, a hash of the secret is transmitted across the network in clear-text. This may result in the...