2618 matches found
Shell In A Box HTTPS fallback DNS binding vulnerability
Shell In A Box is a soft SSH terminal product for accessing remote Linux servers. A security vulnerability in the HTTPS fallback implementation of Shell In A Box allows remote attackers to perform DNS rebinding attacks using the '/plain' URL...
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails
More info at https://symfony.com/cve-2016-1902...
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails
More info at https://symfony.com/cve-2016-1902...
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails
More info at https://symfony.com/cve-2016-1902...
Microsoft TLS Session Resumption Interoperability Improvement Advisory (3109853)
This host is missing an important security update according to Microsoft advisory 3109853. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
Hardcoded credentials
The HTTPS fallback implementation in Shell In A Box aka shellinabox before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL...
UBUNTU-CVE-2015-8400
The HTTPS fallback implementation in Shell In A Box aka shellinabox before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL...
CVE-2015-8400
The HTTPS fallback implementation in Shell In A Box aka shellinabox before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL...
SUSE SLES11 Security Update : samba (SUSE-SU-2016:0032-1)
This update for Samba fixes the following security issues : - CVE-2015-5330: Remote read memory exploit in LDB bnc958586. - CVE-2015-5252: Insufficient symlink verification file access outside the share bnc958582. - CVE-2015-5296: No man in the middle protection when forcing smb encryption on the...
CVE-2015-8400: Undefined Security Weakness
The HTTPS fallback implementation in Shell In A Box aka shellinabox before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL...
PT-2016-3903
Name of the Vulnerable Software and Affected Versions Shell In A Box versions prior to 2.19 Description The issue makes it easier for remote attackers to conduct DNS rebinding attacks. This is due to the HTTPS fallback implementation in the affected software. The attack can be conducted via the...
CVE-2015-7191: Improper Neutralization of Input During Web Page Generation
Mozilla Firefox before 42.0 on Android improperly restricts URL strings in intents, which allows attackers to conduct cross-site scripting XSS attacks via vectors involving an intent: URL and fallback navigation, aka "Universal XSS UXSS."...
PT-2015-2622
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 42.0 on Android Description The issue exists due to improper restriction of URL strings, allowing a remote attacker to conduct cross-site scripting XSS attacks. This can be achieved through vectors involving a...
Scientific Linux Security Update : pcs on SL6.x i386/srpm/x86_64 (20150512)
It was found that the pcs daemon did not sign cookies containing session data that were sent to clients connecting via the pcsd web UI. A remote attacker could use this flaw to forge cookies and bypass authorization checks, possibly gaining elevated privileges in the pcsd web UI. Note: the pcsd w...
pcs security update
CentOS Errata and Security Advisory CESA-2015:0990 Updated pcs packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base...
Security: Wrong security context loaded when using SAML2 STS Login Module
It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...
CVE-2015-1843
The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position...
docker: regression of CVE-2014-5277
It was found that the fix for the CVE-2014-5277 issue was incomplete: the docker client could under certain circumstances erroneously fall back to HTTP when an HTTPS connection to a registry failed. This could allow a man-in-the-middle attacker to obtain authentication and image data from traffic...
Debian DLA-176-1 : mono security update
Three issues with Mono's TLS stack are addressed. CVE-2015-2318 Mono's implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. 'SKIP-TLS' CVE-2015-2319 Mono's implementation of SSL/TLS also contained...