1549 matches found
Dell iDRAC IPMI 1.5 Insufficient Session ID Randomness
""" For testing purposes only. c Yong Chuan, Koh 2014 """ from time import sleep from socket import from struct import from random import import sys, os, argparse HOST = None PORT = 623 bufsize = 1024 recv = "" create socket UDPsock = socketAFINET,SOCKDGRAM UDPsock.settimeout2 data = 21 offset of...
EMC RSA Adaptive Authentication authentication bypass
Incorrect processing for device binding challenge...
CVE-2014-4631
RSA Adaptive Authentication On-Premise 6.0.2.1 through 7.1 P3, when using device binding in a Challenge SOAP call or using the RSA Adaptive Authentication Integration Adapters with Out-of-Band Phone Authentify functionality, conducts permanent device binding even when authentication fails, which...
Authentication flaw
RSA Adaptive Authentication On-Premise 6.0.2.1 through 7.1 P3, when using device binding in a Challenge SOAP call or using the RSA Adaptive Authentication Integration Adapters with Out-of-Band Phone Authentify functionality, conducts permanent device binding even when authentication fails, which...
PT-2014-6037
Name of the Vulnerable Software and Affected Versions RSA Adaptive Authentication On-Premise versions 6.0.2.1 through 7.1 P3 Description The issue allows remote attackers to bypass authentication due to permanent device binding, even when authentication fails, specifically when using device bindi...
CVE-2014-4631: Improper Authentication
RSA Adaptive Authentication On-Premise 6.0.2.1 through 7.1 P3, when using device binding in a Challenge SOAP call or using the RSA Adaptive Authentication Integration Adapters with Out-of-Band Phone Authentify functionality, conducts permanent device binding even when authentication fails, which...
SMTP NTLM Domain Extraction
Extract the Windows domain name from an SMTP NTLM challenge. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMTP NTLM Domain Extraction', 'Description' = 'Extract the Windows domain name from ...
Cisco IOS XE Software Challenge/Response Bypass Vulnerability
A vulnerability in the request system shell command supported by specific Cisco IOS XE platforms WS-C3850, WS-C3650, AIR-CT5760, and WS-C4500X could allow an authenticated, local attacker with administrative privilege 15 to access the underlying Linux root shell. The vulnerability is due to...
DARPA Working on Provably Secure Embedded Software
DARPA is the birthplace of the network that eventually became today’s Internet, and the agency has spent the decades since it released that baby out into the world trying to find new ways defend it. That task has grown ever more complex and difficult, and now DARPA is working on a new kind of...
Documents in Long-Running Yahoo FISC Challenge Case Published
During a long-running secret dispute between Yahoo and government officials over the constitutionality of orders from the federal government to turn over data belonging to Yahoo users, the company was facing fines of $250,000 for refusing to comply with the order. The revelation is contained in a...
CVE-2014-5703
The Slingo Lottery Challenge aka com.slingo.slingolotterychallenge application 1.0.34 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Design/Logic Flaw
The Slingo Lottery Challenge aka com.slingo.slingolotterychallenge application 1.0.34 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-5703
The Slingo Lottery Challenge aka com.slingo.slingolotterychallenge application 1.0.34 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-5703
The CVE-2014-5703 entry concerns the Android app Slingo Lottery Challenge (com.slingo.slingolotterychallenge) version 1.0.34. Affected component: SSL/TLS certificate validation in the app’s network trust handling. Root cause: the application does not verify X.509 certificates from SSL servers, en...
CVE-2014-5703: Undefined Security Weakness
The Slingo Lottery Challenge aka com.slingo.slingolotterychallenge application 1.0.34 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
PT-2014-6688
Name of the Vulnerable Software and Affected Versions The Slingo Lottery Challenge application version 1.0.34 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509...
FLARE IDA Pro Script Series: Automatic Recovery of Constructed Strings in Malware
The FireEye Labs Advanced Reverse Engineering FLARE Team is dedicated to sharing knowledge and tools with the community. We started with the release of the FLARE On Challenge in early July where thousands of reverse engineers and security enthusiasts participated. Stay tuned for a write-up of the...
Banana Dance CMS and Wiki SQL Injection
No description provided by source. +-----------------------+ | Banana Dance CMS+Wiki | +-----------------------+ Vulnerable Web-App : Banana Dance CMS+Wiki Vulnerability : SQLi Author : Aodrulez. Email : [email protected] Google-Dork : : Guess it. Tested on : Ubuntu 10.04 Web-App :...
Painkiller <= 1.35 in-game cd-key alpha-numeric Buffer Overflow Exploit
No description provided by source. / by Luigi Auriemma / include stdio.h include stdlib.h include string.h include time.h / Painkiller packet's password encoder/decoder 0.1 by Luigi Auriemma e-mail: [email protected] web: http://aluigi.altervista.org INTRODUCTION ============ When you want to...
Microsoft Windows 2000 telnet.exe NTLM Authentication Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1683/info By default, the telnet client telnet.exe shipped with Microsoft Windows 2000 utilizes Windows NT Challenge/Response NTLM as an authentication method. When establishing a connection to a host, the telnet client...