[SECURITY] Fedora 22 Update: krb5-1.13.1-2.fc22

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form...

CVE-2015-1147

Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers to obtain sensitive information by sniffing the network...

Open redirect

Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2015-1147

Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2015-1147

CVE-2015-1147 concerns Open Directory Client in Apple OS X prior to 10.10.3. The issue involves unencrypted password-change requests under certain conditions with missing certificates, enabling remote attackers to sniff and obtain sensitive data. The description does not specify affected versions...

CVE-2015-1147: Exposure of Sensitive Information to an Unauthorized Actor

Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers to obtain sensitive information by sniffing the network...

PT-2015-5129

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.10.3 Description The issue concerns the Open Directory Client in Apple OS X, which in certain circumstances involving missing certificates, sends unencrypted password-change requests. This allows remote attacker...

UBUNTU-CVE-2015-0812

Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdoma...

Mandriva Linux Security Advisory : ejabberd (MDVSA-2015:175)

Updated ejabberd packages fix security vulnerability : A flaw was discovered in ejabberd that allows clients to connect with an unencrypted connection even if starttlsrequired is set CVE-2014-8760. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

SEC Consult SA-20150227-0 :: Multiple vulnerabilities in Loxone Smart Home

SEC Consult Vulnerability Lab Security Advisory 20150227-0 ======================================================================= title: Multiple vulnerabilities product: Loxone Smart Home vulnerable version: Firmware: 5.49; Android-App: 3.4.1 fixed version: 6.3 impact: High homepage:...

Viber code execution

Unsafe Javascript interface in combination with unencrypted data transmission...

SPCanywhere Code Injection Vulnerability

SPCanywhere is an application for accessing the Siemens SPC anti-theft alarm system. SPCanywhere suffers from a security vulnerability where unencrypted code is loaded, allowing an attacker to inject code and perform arbitrary actions on a mobile device...

[SECURITY] Fedora 20 Update: krb5-1.11.5-18.fc20

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form...

PT-2015-5378

Name of the Vulnerable Software and Affected Versions Siemens SPCanywhere affected versions not specified Description The issue concerns the lack of encryption during code loading in the Siemens SPCanywhere application for Android. This allows man-in-the-middle attackers to execute arbitrary code...

Loxone Smart Home CSRF / XSS / DoS / Credential Leakage

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Loxone Smart Home vulnerable version: Firmware: 5.49; Android-App: 3.4.1 fixed version: 6.3 impact: High homepage: http://www.loxone.com...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...