765 matches found
JSON Libraries Patched Against Invalid Curve Crypto Attack
A number of JSON libraries using the JSON Web Encryption specification JWE to create, sign and encrypt access tokens have been patched against an attack that allows for the recovery of a private key. Researcher Antonio Sanso of Adobe said the go-jose, node-jose, jose2go, Nimbus JOSE+WT and jose4...
Invalid Curve Attack
node-jose, nimbus-jose-jwt and jose4j are vulnerable to invalid curve attacks. These attacks are possible when using key agreement with Elliptic Curve Diffie-Hellman Ephemeral Static ECDH-ES, allowing attackers to recover the private secret key...
Invalid Curve Attack
Overview Affected versions of node-jose are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static ECDH-ES is used. Proof of Concept Recommendation Update to version 0.9.3 or...
Critical vulnerability in JSON Web Encryption (JWE) - RFC 7516
tl;dr if you are using go-jose, node-jose, jose2go, Nimbus JOSE+JWT or jose4j with ECDH-ES please update to the latest version. RFC 7516 aka JSON Web Encryption JWE hence many software libraries implementing this specification used to suffer from a classic Invalid Curve Attack. This would allow a...
tube8.es XSS vulnerability
Vulnerable URL: http://www.tube8.es/porntags/y9o5z"jve1f/?page== Details: Description| Value ---|--- Patched:| Yes, at 24.03.2017 Latest check for patch:| 24.03.2017 04:57 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 125468 VIP website status:| No Check...
DEBIAN-CVE-2016-3159
The fpufxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits...
DEBIAN-CVE-2016-3158
The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOT...
UBUNTU-CVE-2016-3158
The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOT...
ES Task Manager (Task Killer ) - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities
HackApp vulnerability scanner discovered that application ES Task Manager Task Killer published at the 'play' market has multiple vulnerabilities...
OpenGL ES 2.0 Demo - Suspicious files vulnerabilities
HackApp vulnerability scanner discovered that application OpenGL ES 2.0 Demo published at the 'play' market has multiple vulnerabilities...
OpenGL ES 3.0 benchmark - Customized SSL, Insecure KeyStore, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application OpenGL ES 3.0 benchmark published at the 'play' market has multiple vulnerabilities...
SUSE-SU-2016:0564-1 Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues: - update to Firefox 38.6.1 ESR bsc967087 MFSA 2016-14/CVE-2016-1523 bmo1246093 Vulnerabilities in Graphite 2...
Digi Connect ES 4/8 SB with Switch, Digi Connect ES 4/8 SB 弱口令
参考链接: http://ftp1.digi.com/support/documentation/90000565P1.pdf...
netdoktor.de XSS vulnerability
Vulnerable URL: http://www.netdoktor.de/search/es-ajax/ Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 10:58 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 12410 Google Pagerank| 6 VIP website status:| Yes...
cam4.es XSS vulnerability
Vulnerable URL: http://www.cam4.es/paygate?contextual=gifts-female%22%3E%3Csvg/onload=alert%28/XSSPOSED/%29%3E=ppgi=en=296857270=basic=basic-noprice=5=1=true Details: Description| Value ---|--- Patched:| Yes, at 25.11.2015 Latest check for patch:| 25.11.2015 09:03 GMT Vulnerability type:| XSS...
Buffer Overflow Vulnerability in Multiple TIBCO Products
TIBCO Rendezvous is a middleware product that helps users rapidly build and deploy large-scale distributed applications; Substation ES is a substation product that integrates communication software and provides real-time information exchange; Messaging Appliance is a suite of messaging software...
CVE-2015-4555
The provided documents specify a buffer overflow in the HTTP management interfaces of TIBCO Rendezvous products (Rendezvous before 8.4.4, Rendezvous Network Server before 1.1.1, Substation ES before 2.9.0, Messaging Appliance before 8.7.2). The root cause is an overflow in the HTTP administrative...
Microsoft Office 2007 MSO.dll Arbitrary Free Exploit
Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=417&can=1 The following crash was observed in Microsoft Office 2007 with Microsoft Office File Validation Add-In disabled and Application Verifier enabled for testing and...
CVE-2015-1234
Race condition in gpu/commandbuffer/service/gles2cmddecoder.cc in Google Chrome before 41.0.2272.118 allows remote attackers to cause a denial of service buffer overflow or possibly have unspecified other impact by manipulating OpenGL ES commands...
Race condition
Race condition in gpu/commandbuffer/service/gles2cmddecoder.cc in Google Chrome before 41.0.2272.118 allows remote attackers to cause a denial of service buffer overflow or possibly have unspecified other impact by manipulating OpenGL ES commands...