CVE-2016-3237: Undefined Security Weakness

Kerberos in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows man-in-the-middle attackers to bypass authentication via vectors related to a fallback to NTLM...

SQLite3 -- Tempdir Selection Vulnerability

KoreLogic security reports: Affected versions of SQLite reject potential tempdir locations if they are not readable, falling back to '.'. Thus, SQLite will favor e.g. using cwd for tempfiles on such a system, even if cwd is an unsafe location. Notably, SQLite also checks the permissions of '.', b...

D-Link Patches Weak Crypto in mydlink Devices

Browser makers and other tech companies have gone to great pains to beef up weak crypto libraries, in particular those that are exposed to fallback attacks such as POODLE. Attackers exploiting these vulnerabilities are able to dial back the encryption protecting communication to SSLv2 and SSLv3,...

CVE-2016-1573

Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in place of a fallback image supplied by a scope...

OpenSSH < 7.2 Untrusted X11 Forwarding Fallback Security Bypass

According to its banner, the version of OpenSSH running on the remote host is prior to 7.2. It is, therefore, affected by a security bypass vulnerability due to a flaw in ssh1 that is triggered when it falls back from untrusted X11 forwarding to trusted forwarding when the SECURITY extension is...

Fedora 23 : shellinabox-2.19-1.fc23 (2015-1c773e8702)

Added support for middle-click paste Improved iOS support New logic to enable soft keyboard icon Disable HTTPS fallback using the URL /plain. Consequently disables automatic upgrades from HTTP to HTTPS CVE-2015-8400 Note that Tenable Network Security has extracted the preceding description block...

F5 BIG-IP - BIG-IP last hop kernel module vulnerability CVE-2015-5516

The remote host is missing a security patch. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if description...

Shell In A Box HTTPS fallback DNS binding vulnerability

Shell In A Box is a soft SSH terminal product for accessing remote Linux servers. A security vulnerability in the HTTPS fallback implementation of Shell In A Box allows remote attackers to perform DNS rebinding attacks using the '/plain' URL...

CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails

More info at https://symfony.com/cve-2016-1902...

CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails

More info at https://symfony.com/cve-2016-1902...

CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails

More info at https://symfony.com/cve-2016-1902...

Microsoft TLS Session Resumption Interoperability Improvement Advisory (3109853)

This host is missing an important security update according to Microsoft advisory 3109853. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

UBUNTU-CVE-2015-8400

The HTTPS fallback implementation in Shell In A Box aka shellinabox before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL...

Hardcoded credentials

The HTTPS fallback implementation in Shell In A Box aka shellinabox before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL...

CVE-2015-8400

The HTTPS fallback implementation in Shell In A Box aka shellinabox before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL...

CVE-2015-8400: Undefined Security Weakness

The HTTPS fallback implementation in Shell In A Box aka shellinabox before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL...

SUSE SLES11 Security Update : samba (SUSE-SU-2016:0032-1)

This update for Samba fixes the following security issues : - CVE-2015-5330: Remote read memory exploit in LDB bnc958586. - CVE-2015-5252: Insufficient symlink verification file access outside the share bnc958582. - CVE-2015-5296: No man in the middle protection when forcing smb encryption on the...

PT-2015-2622

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 42.0 on Android Description The issue exists due to improper restriction of URL strings, allowing a remote attacker to conduct cross-site scripting XSS attacks. This can be achieved through vectors involving a...

CVE-2015-7191: Improper Neutralization of Input During Web Page Generation

Mozilla Firefox before 42.0 on Android improperly restricts URL strings in intents, which allows attackers to conduct cross-site scripting XSS attacks via vectors involving an intent: URL and fallback navigation, aka "Universal XSS UXSS."...

Scientific Linux Security Update : pcs on SL6.x i386/srpm/x86_64 (20150512)

It was found that the pcs daemon did not sign cookies containing session data that were sent to clients connecting via the pcsd web UI. A remote attacker could use this flaw to forge cookies and bypass authorization checks, possibly gaining elevated privileges in the pcsd web UI. Note: the pcsd w...