Apache Tomcat 9.0.x < 9.0.2 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700704.pasl...

Apache Tomcat 8.5.x < 8.5.24 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700692.pasl...

Apache Tomcat 9.0.x < 9.0.5 Insecure CGI Servlet Search Algorithm Description Weakness

Binary data 700705.pasl...

Amazon Is Losing the War on Fraudulent Sellers

Excellent article on fraudulent seller tactics on Amazon. The most prominent black hat companies for US Amazon sellers offer ways to manipulate Amazon's ranking system to promote products, protect accounts from disciplinary actions, and crush competitors. Sometimes, these black hat companies brib...

IBM Security Key Lifecycle Manager: All Security Bulletins

Summary This page lists all the security bulletins that are released for IBM Security Key Lifecycle Manager. Vulnerability Details Security Bulletin: IBM Security Key Lifecycle Manager stores unencrypted password CVE-2016-6092 --- Security Bulletin: IBM Security Key Lifecycle Manager uses Less...

Artificial Intelligence May Not 'Hallucinate' After All

What makes an algorithm mistake a helicopter for a gun? Researchers think the answer has to do more with man than machine...

Schneider Electric Modicon Multiple Controllers Weak Encryption Algorithm

Binary data 720150.prm...

Mitsubishi MELSEC-Q Ethernet Interface Modules Weak Encryption Algorithm

Binary data 720090.prm...

Unauthorized Modification

Java SE and Java SE Embedded are vulnerable to unauthenticated modification attacks. An unauthenticated attacker can exploit a flaw in the Security component of OpenJDK which does not allow users to restrict the set of algorithms allowed for Jar integrity verification allowing an attacker to modi...

Integer Overflow

Wireshark, previously known as Ethereal, is a network protocol analyzer, which is used to capture and browse the traffic running on a computer network. Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or...

Stack-Based Buffer Overflow

Wireshark, previously known as Ethereal, is a network protocol analyzer, which is used to capture and browse the traffic running on a computer network. Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or...

Improper Signature Validation

The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security TLS. It was found that GnuTLS did not check activation and expiration dates of CA certificates. This could cause an application using GnuTLS to incorrectly accept a certificate as...

Improper Signature Validation

The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security TLS. It was found that GnuTLS did not check activation and expiration dates of CA certificates. This could cause an application using GnuTLS to incorrectly accept a certificate as...

Information Disclosure

IBM Java SE is vulnerable to information disclosure. The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the...

Timing Attack

jenkins is vulnerable to timing attack. A remote attacker is able to determine API tokens through a brute-force approach of analyzing server response time to guess the value of the API tokens. This is due to the verification of the API tokens not being performed using a constant-time algorithm...

Timing Attack

jenkins is vulnerable to timing attack. A remote attacker is able to bypass CSRF protection mechanism through a brute-force approach of analyzing server response time to guess the value of CSRF tokens. This is due to the verification of the CSRF tokens not being performed using a constant-time...

Information Disclosure

Java is vulnerable to information disclosure. When generating DSA signatures, the security component in OpenJDK fails to check the digest algorithm strength. The use of a digest weaker than the key strength could lead to the generation of signatures that are weaker than expected and attackers may...

Timing Attack

It was discovered that the RSA algorithm in the OpenJDK Security component did not sufficiently preform "blinding" while performing operations using private keys. An attacker able to measure timing differences of those operations could possibly leak information about the keys used...

Denial Of Service (DoS) And Remote Code Execution (RCE)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user...

Denial Of Service (DoS)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user...