PT-2019-17706

Name of the Vulnerable Software and Affected Versions EARCLINK ESPCMS-P8 Description The issue concerns a SQL injection in the install pack/index.php ac=Member&at=verifyAccount endpoint, specifically in the verify key parameter. This could potentially allow an attacker to retrieve sensitive...

PT-2019-6336 · D Link · D-Link Dir-822

Name of the Vulnerable Software and Affected Versions: D-Link DIR-822 B1 version 202KRb06 Description: The issue is related to insufficient checking of arguments passed to a command when handling the WPSPIN parameter in the SetWiFiVerifyAlpha.php script. This could allow a remote attacker to impa...

UBUNTU-CVE-2018-19653

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verifyoutgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade...

DEBIAN-CVE-2018-19653

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verifyoutgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade...

PT-2018-15031 · Hashicorp +1 · Hashicorp Consul +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul versions 0.5.1 through 1.4.0 Description: The issue arises from the improper documentation of the verify outgoing setting, allowing HashiCorp Consul to use cleartext agent-to-agent RPC communication. This affects versions 0.5...

ALPINE-CVE-2018-19841

The function WavpackVerifySingleBlock in openutils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service out-of-bounds read and application crash via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack...

WavPack denial of service vulnerability

WavPack is an open source, free audio lossless compression software. A security vulnerability exists in the openutils.c file 'WavpackVerifySingleBlock' function of the libwavpack.a static link library in WavPack 5.1.0 and earlier versions. An attacker can exploit this vulnerability to cause a...

SUSE SLED12 / SLES12 Security Update : libgcrypt (SUSE-SU-2018:2452-2)

This update for libgcrypt fixes the following issues : The following security vulnerability was addressed : CVE-2018-0495: Mitigate a novel side-channel attack by enabling blinding for ECDSA signatures bsc1097410. The following other issues were fixed: Extended the fipsdrv dsa-sign and dsa-verify...

PT-2018-13427

Name of the Vulnerable Software and Affected Versions axTLS version 2.1.3 and earlier Description The issue concerns the sig verify function in x509.c, where the PKCS1 v1.5 signature verification process blindly trusts the declared lengths in the ASN.1 structure. This can be exploited by a remote...

PT-2018-13455

In sig verify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...

PT-2018-13428

Name of the Vulnerable Software and Affected Versions axTLS versions 2.1.3 and earlier Description The issue concerns the PKCS1 v1.5 signature verification in the sig verify function, which does not properly handle excess data after the hash value. This allows a remote attacker to forge signature...

rpm4 -- regression in -setperms, -setugids and -restore

rpm4 reports: Regression in -setperms, -setugids and -restore Note that this update can not automatically fix possible damage done by using -setperms, -setugids or -restore with rpm 4.14.2, it merely fixes the functionlity itself. Any damage needs to be investigated and fixed manually, such as...

PT-2018-13228

Name of the Vulnerable Software and Affected Versions Openswan versions prior to 2.6.50.1 Description The issue concerns the RSA implementation in the verify signed hash function, which fails to verify the padding string value during PKCS1 v1.5 signature verification. This allows a remote attacke...

A week in security (September 10 – 16)

Last week on Malwarebytes Labs, we assessed the security of a portable router, identified ways to waste a scammer's time, named the many faces of omnichannel fraud, questioned the security of 2FAs, profiled a massive tech support scam operation, and exposed a new HMRC phishing campaign. Other...

U.S. Mobile Giants Want to be Your Online Identity

The four major U.S. wireless carriers today detailed a new initiative that may soon let Web sites eschew passwords and instead authenticate visitors by leveraging data elements unique to each customer's phone and mobile subscriber account, such as location, customer reputation, and physical...

Security update for libgcrypt (moderate)

This update for libgcrypt fixes the following issues: The following security vulnerability was addressed: - CVE-2018-0495: Mitigate a novel side-channel attack by enabling blinding for ECDSA signatures bsc1097410. The following other issues were fixed: - Extended the fipsdrv dsa-sign and dsa-veri...

ARM mbedTLS Design Vulnerability

ARM mbedTLS is a product from ARM UK that provides secure communication and encryption capabilities for mbed products. A security vulnerability exists in the 'mbedtlssslgetverifyresult' function in ARM mbedTLS version 2.7.0 and earlier, which stems from the program's failure to properly sign...

verify-www.com XSS vulnerability

Open Bug Bounty ID: OBB-636538 Description| Value ---|--- Affected Website:| verify-www.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

kernel: AIO interface didn't use rw_verify_area() for checking mandatory locking on files and size of access

It was found that AIO interface didn't use the proper rwverifyarea helper function with extended functionality, for example, mandatory locking on the file. Also rwverifyarea makes extended checks, for example, that the size of the access doesn't cause overflow of the provided offset limits. This...

UBUNTU-CVE-2018-12020

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represen...