5661 matches found
DNN (DotNetNuke) 7.0.0 < 9.3.1 Multiple Vulnerabilities
The version of DNN Platform formerly DotNetNuke running on the remote host is 7.0.0 or later but prior to 9.3.1. It is, therefore, affected by multiple vulnerabilities including the following: - A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input befo...
DEBIAN-CVE-2019-9498
The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication,...
CVE-2018-1925
IBM WebShere MQ 9.1.0.0, 9.1.0.1, 9.1.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 152925...
CVE-2019-9498
The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication,...
Meet ‘TajMahal,’ A New and Highly Advanced APT Framework
SINGAPORE – Researchers at Kaspersky Lab have discovered a new, highly sophisticated advanced persistent threat APT framework targeting a single Central Asian diplomatic agency. Malware samples associated with the APT reveal a complex never-before-seen code base, making it extremely hard to detec...
Unhackable Cryptography?
A recent article overhyped the release of EverCrypt, a cryptography library created using formal methods to prove security against specific attacks. The Quanta magazine article sets off a series of "snake-oil" alarm bells. The author's Github README is more measured and accurate, and illustrates...
Fedora Update for golang-googlecode-go-crypto FEDORA-2019-3f561ba0be
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 29 Update: golang-googlecode-go-crypto-0-0.28.20190324gitb7391e9.fc29
Supplementary Go cryptography libraries...
[SECURITY] Fedora 28 Update: golang-googlecode-go-crypto-0-0.25.20190324gitb7391e9.fc28
Supplementary Go cryptography libraries...
openSUSE: Security Advisory for python-cryptography, python-pyOpenSSL (openSUSE-SU-2019:1104-1)
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
openSUSE Security Update : python-cryptography / python-pyOpenSSL (openSUSE-2019-1104)
This update for python-cryptography, python-pyOpenSSL fixes the following issues : Security issues fixed : - CVE-2018-1000808: A memory leak due to missing reference checking in PKCS12 store handling was fixed bsc1111634 - CVE-2018-1000807: A use-after-free in X509 object handling was fixed...
A Go implementation of Poly1305 that makes sense
Poly1305 is a Message Authentication Code--a cryptographic primitive for authenticating a message with a shared secret key, like HMAC. Although its really a fraction of the complexity of e.g. elliptic curves, most of the implementations Ive read look decidedly like magic, mysteriously multiplying...
Security update for putty (moderate)
openSUSE Security Update: Security update for putty Announcement ID: openSUSE-SU-2019:1123-1 Rating: moderate References: 1129633 Cross-References: CVE-2019-9894 CVE-2019-9895 CVE-2019-9896 CVE-2019-9897 CVE-2019-9898 Affected Products: openSUSE Backports SLE-15 An update that fixes 5...
Security update for python-cryptography, python-pyOpenSSL (important)
openSUSE Security Update: Security update for python-cryptography, python-pyOpenSSL Announcement ID: openSUSE-SU-2019:1104-1 Rating: important References: 1021578 1052927 1111634 1111635 1119077 Cross-References: CVE-2018-1000807 CVE-2018-1000808 Affected Products: openSUSE Leap 42.3 An update th...
Security for Connected Devices
With this post, I want to continue from earlier discussions on security posted here and here and focus on Connected Devices or the Internet of Things IoT. IoT typically represents a network of physical objects or “things” embedded with electronics, software, sensors, and connectivity to enable...
openSUSE Security Update : python-cryptography (openSUSE-2019-857)
This update for python-cryptography fixes the following issues : - CVE-2018-10903: The finalizewithtag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalizewithtag an attacker could craft an invalid payload with a shortened tag e.g. ...
PuTTY < 0.71 Multiple Vulnerabilities
The remote host has a version of PuTTY installed that is prior to 0.71. It is, therefore, affected by multiple vulnerabilities including: - A remotely triggerable buffer overflow in any kind of server-to-client forwarding. CVE-2019-9895 - Potential recycling of random numbers used in cryptography...
Security Bulletin: IBM Security Identity Manager Virtual Appliance is affected by multiple vulnerabilities (CVE-2018-1966, CVE-2018-1964, CVE-2018-1965)
Summary IBM Security Identity Manager Virtual Appliance ISIM VA has addressed the following vulnerabilities due to an application error that causes an error message to contain sensitive information, embedded code by untrusted websites that can allow authorized users to unknowingly alter the...
