OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

Design/Logic Flaw

IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 supports unencrypted sessions, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2014-6136

IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 supports unencrypted sessions, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2014-6136

Product: IBM Security AppScan Standard 8.x and 9.x (before 9.0.1.1 FP1). Issue: unencrypted sessions that allow remote attackers to sniff network traffic and obtain sensitive information. Impact: exposure of sensitive data via network sniffing. Status: CVE-2014-6136 details are supported by multi...

IBM Security AppScan Standard Information Disclosure Vulnerability (CNVD-2015-00884)

IBM Security AppScan Standard is a set of security testing tools for Web applications from IBM in the United States. The tool automates dynamic and static security vulnerability scanning during the application development lifecycle. A security vulnerability exists in IBM Security AppScan Standard...

NFL Mobile App Leaks Unencrypted Credentials

Update – As if the National Football League doesn’t have enough to worry about during Super Bowl week with deflated footballs and cheating allegations marring its most important event, a security firm has found a glaring vulnerability in its mobile application. Just in time for the big game, NFL...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

Panasonic Arbitrator Back-End Server (BES) uses unencrypted communication

Overview Panasonic Arbitrator Back-End Server BES uses an unencrypted channel to transmit data. Description CWE-319: Cleartext Transmission of Sensitive Information Panasonic Arbitrator Back-End Server BES uses an unencrypted channel to transmit data between the client and server. It has been...

SAP applications multiple security vulnerabilities

Unauthorized access, crossite scripting, backdoor account, authentication bypass, unencrypted password transfer...

Password Manager Pro Pro MSP - Blind SQL Injection

Password Manager Pro Pro MSP - Blind SQL Injection Authenticated blind SQL injection in Password Manager Pro / Pro MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 08/11/2014 / Last...

The ASUS RT-series of wireless routers vulnerable, may suffer from the middleman attack-a vulnerability warning-the black bar safety net

! USA security researchers found that the ASUS RT wireless router to download and Update service is via unencrypted HTTP Protocol, and thus may be subject to MiTM attacks. Security researchers Longenecker in his blog pointed out, the ASUS RT series routers only according to a relatively simple...

[ MDVSA-2014:207 ] ejabberd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:207 http://www.mandriva.com/en/support/security/ Package : ejabberd Date : October 24, 2014 Affected: Business Server 1.0 Problem Description: Updated ejabberd packages fix security vulnerability: A flaw was...

Mandriva Linux Security Advisory : ejabberd (MDVSA-2014:207)

Updated ejabberd packages fix security vulnerability : A flaw was discovered in ejabberd that allows clients to connect with an unencrypted connection even if starttlsrequired is set CVE-2014-8760. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

DEBIAN-CVE-2014-8760

ejabberd before 2.1.13 does not enforce the starttlsrequired setting when compression is used, which causes clients to establish connections without encryption...

MGASA-2014-0417 Updated ejabberd packages fix security vulnerability

A flaw was discovered in ejabberd that allows clients to connect with an unencrypted connection even if starttlsrequired is set CVE-2014-8760...