Belden GarrettCom 6K/10K Switches Multiple Vulnerabilities

Belden GarrettCom 6K and 10KT Magnum series network switches are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Cuvva: cuvva.com vulnerable to sweet32

To the Cuvva security team, i was going through your website and i thought to look for latest cryptographic issues as the website uses SSL/TLS i.e,HTTPS target: https:cuvva.com:443 so i quickly run the nmap with ssl-enum script to look for new Vulnerability that is known as "SWEET32" detail about...

SUSE-SU-2017:1250-1 Security update for dovecot22

This update for dovecot22 to version 2.2.29.1 fixes the following issues: This security issue was fixed: - CVE-2017-2669: Don't double-expand %variables in keys. If dict was used as the authentication passdb, using specially crafted %variables in the username could be used to cause DoS bsc1032248...

DEBIAN-CVE-2016-7054

In OpenSSL 1.1.0 before 1.1.0c, TLS connections using -CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS...

EulerOS 2.0 SP2 : openssl098e (EulerOS-SA-2017-1039)

According to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The BNbn2dec function in crypto/bn/bnprint.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote...

openSUSE Security Update : curl (openSUSE-2017-513)

This update for curl fixes the following issues : Security issue fixed : - CVE-2016-9586: libcurl printf floating point buffer overflow bsc1015332 - CVE-2017-7407: The ourWriteOut function in toolwriteout.c in curl might have allowed physically proximate attackers to obtain sensitive information...

Weblate: demo.weblate.org is vulnerable to SWEET32 Vulnerability

Cryptographic protocols like TLS, SSH, IPsec, and OpenVPN commonly use block cipher algorithms, such as AES, Triple-DES, and Blowfish, to encrypt data between clients and servers. To use such algorithms, the data is broken into fixed-length chunks, called blocks, and each block is encrypted...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:1042-1)

This update for curl fixes the following issues: Security issue fixed : - CVE-2016-9586: libcurl printf floating point buffer overflow bsc1015332 - CVE-2017-7407: The ourWriteOut function in toolwriteout.c in curl might have allowed physically proximate attackers to obtain sensitive information...

SUSE-SU-2017:1042-1 Security update for curl

This update for curl fixes the following issues: Security issue fixed: - CVE-2016-9586: libcurl printf floating point buffer overflow bsc1015332 - CVE-2017-7407: The ourWriteOut function in toolwriteout.c in curl might have allowed physically proximate attackers to obtain sensitive information fr...

ssh_scan - A prototype SSH Configuration and Policy Scanner

A SSH configuration and policy scanner Key Benefits Minimal Dependancies - Uses native Ruby and BinData to do its work, no heavy dependancies. Not Just a Script - Implementation is portable for use in another project or for automation of tasks. Simple - Just point sshscan at an SSH service and...

SUSE-SU-2017:0720-1 Security update for java-1_7_1-ibm

This update for java-171-ibm fixes the following issues: Security issue fixed: - CVE-2016-2183: The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remo...

USN-3198-1: OpenJDK 6 vulnerabilities

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes...

Ubuntu: Security Advisory (USN-3194-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3194-1 openjdk-7 vulnerabilities

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes...

USN-3194-1: OpenJDK 7 vulnerabilities

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes...

USN-3179-1: OpenJDK 8 vulnerabilities

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes...

sslscan - tests SSL/TLS enabled services to discover supported cipher suites

This is a fork of ioerror's version of sslscan the original readme of which is included below. Changes are as follows: Highlight SSLv2 and SSLv3 ciphers in output. Highlight CBC ciphers on SSLv3 POODLE. Highlight 3DES and RC4 ciphers in output. Highlight PFS+GCM ciphers as good in output. Highlig...

SA133 : Sweet32 Birthday Attack against DES, 3DES, and Blowfish

SUMMARY Symantec Network ProtectionSy products that use the DES, 3DES, and Blowfish symmetric encryption ciphers in long-lived encrypted SSL/TLS, SSH, or VPN connections are susceptible to the Sweet32 birthday attack. A remote attacker with the ability to observe a long-lived encrypted connection...

Data Exfiltration In Plain Sight: Cloakify Toolset

Data Exfiltration In Plain Sight -Cloakify Toolset Evade DLP/MLS Devices; Social Engineering of Analysts; Evade AV Detection CloakifyFactory transforms any filetype e.g. .zip, .exe, .xls, etc. into a list of harmless-looking strings. This lets you hide the file in plain sight, and transfer the fi...

Extreme ExtremeXOS OpenSSL Vulnerability (VN-2016-002)

Extreme ExtremeXOS is prone to an OpenSSL vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:extremenetworks:exos"; i...