12386 matches found
The vulnerability of the SSL traffic decryption function of Cisco Web Security Appliance lies in insufficient verification of server Secure Sockets Layer certificates. This allows attackers to trigger a service failure.
The vulnerability of the SSL traffic decryption function in Cisco Web Security Appliance relates to insufficient verification of Secure Sockets Layer server certificates. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by installing incorrectly generated...
Meet Extenbro, a new DNS-changer Trojan protecting adware
Recently, we uncovered a new DNS-changer called Extenbro that comes with an adware bundler. These DNS-changers block access to security-related sites, so the adware victims can’t download and install security software to get rid of the pests. From our viewpoint, this might be like sending in an...
CVE-2019-11242
A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificates presented by vCenter. This vulnerability could expose Cohesity user credentials configured to access vCenter...
Sql injection
A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificates presented by vCenter. This vulnerability could expose Cohesity user credentials configured to access vCenter...
CVE-2019-11242
CVE-2019-11242 affects Cohesity DataPlatform 5.x and 6.x before 6.1.1c. Root cause: Cohesity clusters did not validate TLS certificates presented by vCenter, enabling a man‑in‑the‑middle that could expose user credentials used to access vCenter. Impact per sources: potential credential exposure w...
CVE-2019-11242
A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificates presented by vCenter. This vulnerability could expose Cohesity user credentials configured to access vCenter...
CVE-2019-9657
Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs because of incorrect protection of VPN certificates used for initiating a VPN session to the Alarm.com infrastructure on the local camera device...
CVE-2019-9657
The CVE-2019-9657 entry affects Alarm.com ADC-V522IR 0100b9 devices, where the root cause is the incorrect protection of VPN certificates used to initiate a VPN session to the Alarm.com infrastructure on the local camera device. This results in Incorrect Access Control with an impact on confident...
The vulnerability of the syntax analysis procedure for Python interpreter certificates allows attackers to trigger a service failure.
The vulnerability of the syntax analysis procedure for Python interpreter certificates is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...
Dynacolor FCM-MB40 Trust Management Issues Vulnerability
Dynacolor FCM-MB40 is an IP camera from Dynacolor, Taiwan, China. A trust management issue vulnerability exists in the Dynacolor FCM-MB40 v1.2.0.0. The vulnerability stems from the lack of an effective trust management mechanism in the network system or product. An attacker can exploit default...
CVE-2019-1886 Cisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability
A vulnerability in the HTTPS decryption feature of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient validation of Secure Sockets Layer SSL server certificates. An attacker could...
Cisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability
A vulnerability in the HTTPS decryption feature of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient validation of Secure Sockets Layer SSL server certificates. An attacker could...
Nortek Security & Control Linear eMerge 50P/5000P Trust Management Issue Vulnerability
Nortek Security & Control Linear eMerge 50P/5000P is a browser-based access control system from Nortek Security & Control, USA. A vulnerability in Nortek Security & Control Linear eMerge 50P/5000P exists due to a trust management issue. The vulnerability stems from the lack of an effective trust...
Product release: Virtuozzo Infrastructure Platform 3.0
In this release, Virtuozzo Infrastructure Platform offers a wide range of new features that enhance the experience of users working with compute virtualization and software-defined networking functionalities. Additionally, the update delivers stability improvements and addresses bugs found in...
UBUNTU-CVE-2016-7404
OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform...
Sharing the Secrets: Pwning an industrial IoT router
I get involved in a lot of IoT and ICS pen tests and found an interesting device on one of them. I didn’t have enough time on the job to go as deep as I wanted, so got PTP to buy a couple to play with. eBay FTW! It’s an Ewon Flexy IoT Router. It’s important to note that local access / public IP...
kernel security update
3.10.0-957.21.3.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey bug 24817676 3.10.0-957.21.3 - net tcp: enforce tcpminsndmss in tcpmtuprobing Florian Westphal 17199...
Design/Logic Flaw
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections...
