AppDynamics Dashboard Plugin stored password in plain text

AppDynamics Dashboard Plugin stored username and password in its configuration unencrypted in jobs' config.xml files on the Jenkins controller. This password could be viewed by users with Extended Read permission, or access to the Jenkins controller file system. While masked from view using a...

Rabbit-MQ Publisher Plugin stored password in plain text

Rabbit-MQ Publisher Plugin stored the username and password in its configuration unencrypted in its global configuration file on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system. The plugin now stores the password encrypted in the...

Debian DSA-4402-1 : mumble - security update

It was discovered that insufficient restrictions in the connection handling of Mumble, a low latency encrypted VoIP client, could result in denial of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

CVE-2018-5482

NetApp SnapCenter Server prior to 4.1 does not set the secure flag for a sensitive cookie in an HTTPS session which can allow the transmission of the cookie in plain text over an unencrypted channel...

Pixel Update Bulletin—March 2019Stay organized with collectionsSave and categorize content based on your preferences.

The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Google Pixel devices Google devices. For Google devices, security patch levels of 2019-03-05 or later address all issues in this bulletin and all issues in the March 2019 Android...

Data Leakage from Encrypted Databases

Matthew Green has a super-interesting blog post about information leakage from encrypted databases. It describes the recent work by Paul Grubbs, Marie-Sarah Lacharité, Brice Minaud, and Kenneth G. Paterson. Even the summary is too much to summarize, so read it...

F5 Networks BIG-IP : TMM TLS virtual server vulnerability (K10065173)

A BIG-IP virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle MITM attack, despite the attacker not having gained access to t...

CVE-2019-6266

Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patterns. These issues allow remote attackers to downgrade encrypted connections to cleartext...

CVE-2019-6266

Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patterns. These issues allow remote attackers to downgrade encrypted connections to cleartext...

CVE-2019-1683

A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security TLS-encrypted Session Initiation Protocol SIP conversation. The...

CVE-2019-1683: Improper Certificate Validation

A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security TLS-encrypted Session Initiation Protocol SIP conversation. The...

Cisco SPA112, SPA525, and SPA5X5 Series Certificate Validation Vulnerabilities

Cisco SPA112 Series and so on are the products of Cisco Company in the United States.Cisco SPA112 Series is a SPA112 series IP phone.SPA525 Series is a SPA525 series IP phone.SPA5X5 Series is a SPA5X5 series IP phone.Cisco SPA112 Series is a SPA112 series IP phone.SPA525 Series is a SPA525 series...

Cisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation Vulnerability

A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security TLS-encrypted Session Initiation Protocol SIP conversation. The...

CVE-2018-15588

MailMate before 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email...

CVE-2018-15588

MailMate before 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email...

Design/Logic Flaw

MailMate before 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email...

CVE-2018-15588

MailMate before 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email...

PT-2019-9133

Name of the Vulnerable Software and Affected Versions MailMate versions prior to 1.11.3 Description The issue arises from MailMate's mishandling of a suspicious HTML/MIME structure in a signed/encrypted email. Recommendations For versions prior to 1.11.3, update to version 1.11.3 or later to...

CVE-2018-15588: Authentication Bypass by Spoofing

MailMate before 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email...

CVE-2019-1672

A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to bypass a configured drop policy and allow traffic onto the network that should have been denied. The vulnerability is due to the incorre...