Internet Bug Bounty: Divide-and-conquer session key recovery in SSLv2 (CVE-2016-0703)

This is a retroactive submission of CVE-2016-0703, a.k.a. the "Extra Clear" bug, which can lead to the Special DROWN variant of the DROWN attack. After some discussion with the other DROWN authors, I'm submitting on behalf of myself David Adrian and J. Alex Halderman the vulnerability...

Meteocontrol WEB'log Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-133-01 Meteocontrol WEB'log Vulnerabilities that was published May 12, 2016, on the NCCIC/ICS‑CERT web site. Independent researcher Karn Ganeshen has identified one authentication and two information exposure...

Moxa MiiNePort Information Disclosure Vulnerability

Moxa MiiNePort is an embedded device networking module designed for manufacturers to connect serial devices to a network connection. Moxa MiiNePort stores information in clear text and does not provide a protection mechanism, allowing an attacker to view sensitive or configuration information...

samba: Man-in-the-middle attacks possible with NTLMSSP authentication

Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plain text. The attacker could also force the client or...

CVE-2016-1866

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...

PYSEC-2016-23

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream...

New Relic: Password disclosure during signup process

New relic provides user's the option to register new accounts. It was observed that during creation of new account process, user's password is displayed in clear text in response. This leads to disclosure of passwords. There may be another issue here that user's passwords are not stored in hashed...

Clear Vision 3 -Sniper Shooter - Dangerous filesystem permissions, Insecure KeyStore vulnerabilities

HackApp vulnerability scanner discovered that application Clear Vision 3 -Sniper Shooter published at the 'play' market has multiple vulnerabilities...

Clear Glass Transparent Style - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Clear Glass Transparent Style published at the 'play' market has multiple vulnerabilities...

HackerOne: HackerOne Important Emails Notification are sent in clear-text

Our e-mail provider at the time had problems where some e-mails would not be sent out over TLS. Based on data from Google Postmaster Tools, we were seeing as high as 12% of our e-mail from our provider to Google mail servers not encrypted. We opened a case with them on March 31st, 2016, about thi...

USN-2931-1 linux-lts-utopic vulnerabilities

Ben Hawkes discovered that the Linux netfilter implementation did not correctly perform validation when handling IPTSOSETREPLACE events. A local unprivileged attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privileges...

DEBIAN-CVE-2016-0703

The getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to...

D-Link DVG-N5402SP Information Disclosure Vulnerability

The D-Link DVG-N5402SP is a wireless router product from AUO D-Link for voice, fax and shared wireless Internet over IP networks. A security vulnerability exists in the D-Link DVG-N5402SP that originates from the program storing data in clear text. An attacker could exploit the vulnerability to...

GE SNMP/Web Interface adapter information disclosure vulnerability

The GE SNMP/Web Interface adapter is a web server from General Electric that displays current information about an uninterruptible power supply. The GE SNMP/Web Interface adapter file contains information stored in clear text, allowing remote attackers to exploit this vulnerability to obtain...

GE Industrial Solutions UPS SNMP Adapter 4.8 - Multiple Vulnerabilities

GE Industrial Solutions UPS SNMP Adapter 4.8 - Multiple Vulnerabilities Exploit Title: GE Industrial Solutions - UPS SNMP Adapter Command Injection and Clear-text Storage of Sensitive Information Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.geindustrial.com/ Versions...

D-Link DVG­N5402SP - Multiple Vulnerabilities

D-Link DVG­N5402SP - Multiple Vulnerabilities Exploit Title: DLink DVG­N5402SP Multiple Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.dlink.com/ Versions Reported: Multiple - See below CVE-IDs: CVE-2015-7245 + CVE-2015-7246 + CVE-2015-7247 DLink DVG­N5402SP File Path Traversal...

GE Industrial Solutions UPS SNMP Adapter < 4.8 - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: GE Industrial Solutions - UPS SNMP Adapter Command Injection and Clear-text Storage of Sensitive Information Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.geindustrial.com/ Versions Reported: All...

GE Industrial Solutions UPS SNMP Adapter Command Injection

GE Industrial Solutions - UPS SNMP Adapter Command Injection and Clear-text Storage of Sensitive Information Vulnerabilities Timelines: Reported to ICS-CERT on: July 06, 2015 Fix & Advisory Released by GE: January 25, 2015 Vulnerability ID: GEIS16-01 GE Advisory:...

D-Link DVG­N5402SP - Multiple Vulnerabilities

Exploit Title: DLink DVG­N5402SP Multiple Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.dlink.com/ Versions Reported: Multiple - See below CVE-IDs: CVE-2015-7245 + CVE-2015-7246 + CVE-2015-7247 DLink DVG­N5402SP File Path Traversal, Weak Credentials Management, and Sensitive...

MGASA-2015-0483 Updated keepassx packages fix CVE-2015-8378

Updated keepassx package fixes security vulnerability: Cancelling an export operation creates clear text copy of all of the user's KeePassX password database entries. CVE-2015-8378...