PostgreSQL weak cryptography

Username is used as a salt for MD5-hashed passwords. In addition, during authentication hash may be used directly without knowledge of cleartext password...

OpenPGP/GnuPG chosen ciphertext cryptography attack

With CFB mode encryption attacker can recover part of the plaintext if 2 first bytes of the message block are known...

CVE-2004-2555

Riverdeep FoolProof Security 3.9.x on Windows 98 and Windows ME uses weak cryptography arithmetic and XOR operations to relate the Control password to the Administrator password, which allows local users to calculate the Administrator password if they know the Control password and password recove...

Debian DSA-181-1 : libapache-mod-ssl - XSS

Joe Orton discovered a cross site scripting problem in modssl, an Apache module that adds Strong cryptography i.e. HTTPS support to the webserver. The module will return the server name unescaped in the response to an HTTP request on an SSL port. Like the other recent Apache XSS bugs, this only...

Sygate Secure Enterprise replay attacks

Weak cryptography in communications between server and client doesn't protect against replay attacks...

RHEL 2.1 : mod_ssl (RHSA-2002:136)

Updated modssl packages are now available for Red Hat Advanced Server. These updates incorporate a fix for an incorrect bounds check in versions of modssl up to and including version 2.8.9. The modssl module provides strong cryptography for the Apache Web server via the Secure Sockets Layer SSL a...

Spider Sales shopping cart software multiple security vulnerabilities

S-Quadra Advisory 2004-03-03 Topic: Spider Sales shopping cart software multiple security vulnerabilities Severity: High Vendor URL: http://www.spidersales.com Advisory URL: http://www.s-quadra.com/advisories/Adv-20040303.txt Release date: 03 Mar 2004 1. DESCRIPTION "Spider Sales is a powerful...

Adv-20040216.txt

S-Quadra Advisory 2004-02-16 Topic: EarlyImpact ProductCart shopping cart software multiple security vulnerabilities Severity: High Vendor URL: http://www.earlyimpact.com Advisory URL: http://www.s-quadra.com/advisories/Adv-20040216.txt Release date: 16 Feb 2004 1. DESCRIPTION ProductCart is a...

[Full-Disclosure] EarlyImpact ProductCart shopping cart software multiple security vulnerabilities

S-Quadra Advisory 2004-02-16 Topic: EarlyImpact ProductCart shopping cart software multiple security vulnerabilities Severity: High Vendor URL: http://www.earlyimpact.com Advisory URL: http://www.s-quadra.com/advisories/Adv-20040216.txt Release date: 16 Feb 2004 1. DESCRIPTION ProductCart is a...

ProductCart 1.x/2.x - Weak Cryptography

source: https://www.securityfocus.com/bid/9669/info EarlyImpact ProductCart is reportedly prone to multiple vulnerabilities. The specific issues include SQL injection, cross-site scripting and cryptographic weaknesses. These issues could expose sensitive data such as user credentials and allow fo...

CVE-2003-0148

The default installation of MSDE via McAfee ePolicy Orchestrator 2.0 through 3.0 allows attackers to execute arbitrary code via a series of steps that 1 obtain the database administrator username and encrypted password in a configuration file from the ePO server using a certain request, 2 crack t...

CVE-2003-0148

The default installation of MSDE via McAfee ePolicy Orchestrator 2.0 through 3.0 allows attackers to execute arbitrary code via a series of steps that 1 obtain the database administrator username and encrypted password in a configuration file from the ePO server using a certain request, 2 crack t...

Important: Red Hat Security Advisory: openssl security update for Stronghold

Updated versions of Stronghold 3.0 that fix two OpenSSL vulnerabilities are now available. Stronghold 3 contains a number of open source technologies including OpenSSL. Two issues in OpenSSL have recently been discovered: OpenSSL is a commercial-grade, full-featured, and open source toolkit that...

Adobe Acrobat Reader plugin trojaning

Because of weak cryptography it's possible to spoof Adobe signature for Acrobat Reader plugins...

Important: Red Hat Security Advisory: openssl security update for Stronghold

A new Stronghold 3 release is available which contains an updated fix for the OpenSSL ASN1 vulnerability. OpenSSL is a commercial-grade, full-featured, open source toolkit which implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a full-strength...

Important: Red Hat Security Advisory: openssl security update

Updated OpenSSL packages are available for Red Hat Linux Advanced Server. These updates fix multiple protocol parsing bugs, which may cause a denial of service DoS attack or cause SSL-enabled applications to crash. Updated 06 Jan 2003 Added fixed packages for the ia64 architecture. Updated 06 Feb...

Moderate: Red Hat Security Advisory: mod_ssl security update

Updated modssl packages are now available for Red Hat Advanced Server. These updates incorporate a fix for an incorrect bounds check in versions of modssl up to and including version 2.8.9. The modssl module provides strong cryptography for the Apache Web server via the Secure Sockets Layer SSL a...

GnuPG contains format-string vulnerability in handling of encrypted data filename

Overview Some versions of Gnu Privacy Guard GPG contain a format-string vulnerability from improper handling of filenames when decrypting files. Description GPG is an OpenPGP-compliant alternative to PGP to protect electronic communications using public-key cryptography. Versions of GPG prior to...

CVE-2001-1125

CVE-2001-1125 concerns Symantec LiveUpdate prior to 1.6, where the update mechanism did not cryptographically verify downloaded files. This enables a remote attacker to achieve arbitrary code execution via DNS spoofing of the update site (update.symantec.com). The issue affects LiveUpdate version...

Linksys BEFVP41 VPN Server does not follow proper VPN standards

Dear all, A month ago, we discovered a bug in the VPN Server module of the Linksys EtherFast BEFVP41 Cable/DSL VPN Router. Here's the detailed email we sent to Linksys Tech Support: Begin Email Dear Support @ Linksys, We recently heard about your BEFVP41 and thought we'd try it out as we liked th...