458 matches found
Clair - Vulnerability Static Analysis for Containers
Clair is an open source project for the static analysis of vulnerabilities in appc and docker containers. Vulnerability data is continuously imported from a known set of sources and correlated with the indexed contents of container images in order to produce lists of vulnerabilities that threaten...
Symantec Messaging Gateway 10.6.x ACE Library Static Link to Vulnerable SSL Version (SYM16-007)
Symantec Messaging Gateway SMG Appliance management console is susceptible to potential unauthorized loss of privileged information due to an inadvertent static link of an updated component library to a version of SSL susceptible to the Heartbleed vulnerability CVE-2014-0160...
Symantec Messaging Gateway 10.6.x ACE Library Static Link to Vulnerable SSL Version
SUMMARY Symantec Messaging Gateway SMG Appliance 10.6.x management console was susceptible to potential unauthorized loss of privileged information due to an inadvertent static link of an updated component library to a version of SSL susceptible to the Heartbleed vulnerability CVE-2014-0160...
Linux Foundation Badge Program Boost Open Source Security
The Linux Foundation says a new Core Infrastructure Initiative CII Best Practices Badge program launched Tuesday will help companies interested in adopting open source technologies evaluate projects based on security, quality and stability. The CII Best Practices Badge does not issue certificates...
“Bleeding heart”vulnerability can lead to dense code disclosure-vulnerability warning-the black bar safety net
! 1 0 December, the security personnel also discovered the Heartbleed vulnerability in the trail, the use of the vulnerability an attacker can obtain the password of the user and convincing the user to visit a forged website. myhack58 Encyclopedia The Heartbleed Vulnerability, CVE-2 0 1 4-0 1 6 0...
DROWN Vulnerability Remains 'High' Risk, Firms Say
Despite the rush to patch systems at risk to the massive transport layer security TLS vulnerability, known as DROWN, hundreds of cloud services are still at risk of attack. According to two independent research firms, Netskope and Skyhigh Networks, a week after the vulnerability was identified...
Recapping RSA 2016, FBI vs. Apple, and More
Mike Mimoso and Chris Brook recap RSA 2016, including how pervasive the FBI vs. Apple debate has been around the conference, OpenSSL two years after Heartbleed, and why hacking back is always a bad idea. Download: ThreatpostNewsWrapMarch42016.mp3 Music by Chris Gonsalves...
Nearly Two Years After Heartbleed OpenSSL Operating With Renewed Vision
SAN FRANCISCO—Experts have stressed this week that DROWN is no Heartbleed, but at some point in the not too distant future, there’s going to be another major Internet vulnerability and developers at OpenSSL claim they’re battle tested. Rich Salz and Tim Hudson, members of OpenSSL’s development...
OpenSSL to Patch Two Vulnerabilities This Week
OpenSSL is scheduled to update two versions of the software this week, patching a pair of vulnerabilities in the process. The OpenSSL project this morning said the updates will move users to versions 1.0.2f and 1.0.1r and should be available Thursday between 8 a.m. and noon Eastern time. “They wi...
Advantech EKI Vulnerable to Bypass, Possible Backdoor
Researchers have uncovered yet another issue–and potential backdoor–in Advantech’s beleaguered EKI-1322 serial device server. The Dropbear SSH daemon associated with the server, because of heavy modifications, fails to enforce authentication. This makes it so any user who wants to bypass...
OpenSSH Private Crypto Key Leak Patch
OpenSSH today released a patch for a critical vulnerability that could be exploited by an attacker to force a client to leak private cryptographic keys. The attacker would have to control a malicious server in order to force the client to give up the key, OpenSSH and researchers at Qualys said in...
VMware ESXi Multiple OpenSSL Vulnerabilities (VMSA-2014-0004) (Heartbleed)
The remote VMware ESXi host is affected by multiple vulnerabilities in the OpenSSL third-party library : - A flaw exist in the Elliptic Curve Digital Signature Algorithm ECDSA implementation due to a failure to ensure that certain swap operations have a constant-time behavior. An attacker can...
MassBleed - Mass SSL Vulnerability Scanner
USAGE sh massbleed.sh CIDR|IP single|port|subnet port proxy ABOUT This script has four main functions with the ability to proxy all connections: 1. To mass scan any CIDR range for OpenSSL vulnerabilities via port 443/tcp https example: sh massbleed.sh 192.168.0.0/16 2. To scan any CIDR range for...
Advantech EKI Vulnerable to Shellshock, Heartbleed
Twice in the past year, security researchers have found and reported critical vulnerabilities in Modbus gateways built by Advantech that are used to connect serial devices in industrial control environments to IP networks. Most recently, independent security researcher Neil Smith found hard-coded...
Mail.ru: [w1.dwar.ru] Core Dump
Если помните багу с HeartBleed, то там можно было читать оперативную память сервера в поисках Credential информации. Здесь же похожая уязвимость, когда сервер crash-ится, на жестком диске остаётся дамп памяти вместе со всеми данными, которые можно анализировать для выяснения причины падения...
Exploit for Out-of-bounds Read in Openssl
Heartbleed Scanner Network Scanner for OpenSSL Memory Leak C...
Heart drop of blood away? 2 0 million equipment is still under threat-vulnerability warning-the black bar safety net
Heart drop of blood is already a thing of the past? NO! A lapse of more than a year after the infamous the heart of the blood security vulnerabilities and not completely disappeared, still the 2 0 million of network devices present a security threat. According to Shodan, the search results displa...
Advantech EKI Vulnerabilities (Update B)
OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-15-344-01A Advantech EKI Vulnerabilities that was published December 15, 2015, on the NCCIC/ICS-CERT web site. --------- Begin Update B Part 1 of 3 -------- HD Moore of Rapid7 identified several vulnerabilities in...
Amazon Linux: Security Advisory (ALAS-2014-320)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...