How the Crypto Challenge as Action Helped a Major Airline Reduce False Positives While Protecting the Customer Experience

Challenges of Bot Detection: Keeping Defenses High Without Triggering False Positives Identifying bots is important and complicated work. Keeping up with ever-changing bot technologies and attack strategies requires deep knowledge and continuous threat research. The outbreak of the COVID-19...

Security Bulletin: Rational Developer for System z - Add support for TLS v1.2 with MS-CAPI in HCE

Summary IBM Rational Developer for System z has added support for TLS v1.2 with MS-CAPI in the Host Connection Emulator Vulnerability Details CVEID: CVE-2017-1796 DESCRIPTION: IBM Developer for z Systems uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt...

CryptoPro CSP Denial of Service Vulnerability

CryptoPro CSP is a cryptographic software package from the Russian company CryptoPro. The package is a windows/linux based cryptographic service that can be used to create cryptographic messages encryptions, digital signatures, build and validate certificate chains, generate keys and process...

CVE-2019-17006

In Network Security Services NSS before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow...

DEBIAN-CVE-2019-17006

In Network Security Services NSS before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow...

CVE-2019-17006

In Network Security Services NSS before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow...

Buffer overflow

In Network Security Services NSS before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow...

CVE-2019-17006

CVE-2019-17006 : In Network Security Services (NSS) prior to 3.46, several cryptographic primitives lacked input length checks, enabling a heap-based buffer overflow that could crash the application or, per in-document wording, potentially allow code execution. The issue is associated with NSS us...

CVE-2019-17006

In Network Security Services NSS before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow...

Citrix ADC FIPS Compliance/Validation FAQ

General Overview 1. What are Federal Information Processing Standards FIPS? FIPS are standards and guidelines for federal computer systems that are developed by National Institute of Standards and Technology NIST in accordance with the Federal Information Security Management Act FISMA and approve...

Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization Exploit

This Metasploit module exploits the .NET deserialization vulnerability within the RadAsyncUpload RAU component of Telerik UI ASP.NET AJAX that is identified as CVE-2019-18935. In order to do so the module must upload a mixed mode .NET assembly DLL which is then loaded through the deserialization...

Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient include...

Authentication flaw

When SAML authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly handle child elements in SAML responses, allowing a remote attacker to modify a valid SAML response without invalidating its cryptographic signature to bypass SAML authentication security controls. This issue...

Authentication flaw

When SAML authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly handle SAML responses, allowing a remote attacker to modify a valid SAML response without invalidating its cryptographic signature to bypass SAML authentication security controls. This issue affects all Juniper...

CVE-2020-1676 Juniper Networks Mist Cloud UI: SAML authentication response handling vulnerability.

When SAML authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly handle SAML responses, allowing a remote attacker to modify a valid SAML response without invalidating its cryptographic signature to bypass SAML authentication security controls. This issue affects all Juniper...

CVE-2020-4254

IBM Security Guardium Big Data Intelligence 1.0 SonarG uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 175560...

Code injection

IBM Security Guardium Big Data Intelligence 1.0 SonarG uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 175560...

Design/Logic Flaw

IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptographic algorithm used throughout the Cúram application. IBM X-Force ID: 189156...

CVE-2020-4778

CVE-2020-4778 affects IBM Cúram Social Program Management, with vulnerable tokens hashed using MD5 in 7.0.9 and 7.0.10. Root cause: MD5 hashing of a token in a single instance, weaker than SHA-256 currently used in the app. Impact described by IBM: CVSS base score 5.9; confidentiality impact high...

CVE-2020-4778

IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptographic algorithm used throughout the Cúram application. IBM X-Force ID: 189156...