wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...

CVE-2019-14887

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...

CVE-2019-14887

CVE-2019-14887 affects WildFly when using the OpenSSL security provider: the configured enabled-protocols setting is not honored, allowing downgrading TLS for traffic and potentially leaking data. Affected WildFly releases include 7.2.0.GA, 7.2.3.GA, and 7.2.5.CR2. The issue is referenced in Red ...

PT-2020-5188

Name of the Vulnerable Software and Affected Versions Wildfly versions 7.2.0.GA through 7.2.5.CR2 Description A flaw was found when an OpenSSL security provider is used with Wildfly, where the 'enabled-protocols' value in the Wildfly configuration isn't honored. This could allow an attacker to...

CVE-2019-14887: Selection of Less-Secure Algorithm During Negotiation

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...

Information disclosure

In onReadBuffer of StreamingSource.cpp, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID...

CVE-2019-5107: Cleartext Transmission of Sensitive Information

A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to network traffic can easily intercept, interpret, and manipulate data coming from, or destined for e!Cockpit. This includes passwords,...

AMD Downplays CPU Threat Opening Chips to Data Leak Attacks

AMD is seeking to downplay side-channel attacks that can leak potentially sensitive data from its processors released between 2011 and 2019. The “Take A Way” attack, so-called by researchers with the Graz University of Technology in a new analysis this weekend, is a side-channel attack...

AMD Downplays CPU Threat Opening Chips to Data Leak Attacks

AMD is seeking to downplay side-channel attacks that can leak potentially sensitive data from its processors released between 2011 and 2019. The “Take A Way” attack, so-called by researchers with the Graz University of Technology in a new analysis this weekend, is a side-channel attack...

Virgin Media Data Leak Exposes Details of 900,000 Customers

On the same day yesterday, when the US-based telecom giant T-Mobile admitted a data breach, the UK-based telecommunication provider Virgin Media announced that it has also suffered a data leak incident exposing the personal information of roughly 900,000 customers. What happened? Unlike the...

Virgin Media Data Leak Exposes Details of 900,000 Customers

On the same day yesterday, when the US-based telecom giant T-Mobile admitted a data breach, the UK-based telecommunication provider Virgin Media announced that it has also suffered a data leak incident exposing the personal information of roughly 900,000 customers. What happened? Unlike the...

U.S. Dept Of Defense: PII Leak via https://████████

Summary: An attacker can create an account on https://████ and gain access to a wealth of PII for practically every member that is registered on the website. This includes e-mail addresses, physical addresses, telephone numbers, and other information about a vast majority of the US Air Force, as...

openSUSE Security Update : python-azure-agent (openSUSE-2020-261)

This update for python-azure-agent fixes the following issues : python-azure-agent was updated to version 2.2.45 jscECO-80 + Add support for Gen2 VM resource disks + Use alternate systemd detection + Fix /proc/net/route requirement that causes errors on FreeBSD + Add cloud-init auto-detect to...

Xiamen Yishang Network Technology Co., Ltd. website system SQL injection vulnerability

Xiamen Yi Shang Network Technology Co., Ltd. is a company that provides one-stop service of website construction and Internet marketing. A SQL injection vulnerability exists in the website builder system of Xiamen Ecommerce Network Technology Co. An attacker can use this vulnerability to obtain...

Security update for python-azure-agent (moderate)

openSUSE Security Update: Security update for python-azure-agent Announcement ID: openSUSE-SU-2020:0261-1 Rating: moderate References: 1127838 Cross-References: CVE-2019-0804 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update fo...

Hackers leak up to 4 TB of OnlyFans content for download

By Deeba Ahmed OnlyFans is a London-based adult entertainment site immensely popular among content creators and influencers, especially females has been hacked. This is a post from HackRead.com Read the original post: Hackers leak up to 4 TB of OnlyFans content for download...

SQL Injection Vulnerability in SemCMS SE***_Me***.php File

SemCMS is a set of open source foreign trade enterprise website management system, written in php language, can be run under window or linux system. SemCMS SEMe.php file SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive information in the database...

CVE-2019-15875

In FreeBSD 12.1-STABLE before r354734, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r354735, and 11.3-RELEASE before 11.3-RELEASE-p6, due to incorrect initialization of a stack data structure, core dump files may contain up to 20 bytes of kernel da...

CVE-2019-15875: Improper Initialization

In FreeBSD 12.1-STABLE before r354734, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r354735, and 11.3-RELEASE before 11.3-RELEASE-p6, due to incorrect initialization of a stack data structure, core dump files may contain up to 20 bytes of kernel da...

CVE-2020-8989

In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices, which makes it easier for remote attackers to discover this voter's choice by sniffing the network. Fo...