518 matches found
CVE-2018-1000149
A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that...
CVE-2018-1000149
A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that...
Design/Logic Flaw
A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that...
CVE-2018-1000149
The CVE-2018-1000149 entry documents a man-in-the-middle vulnerability in Jenkins Ansible Plugin 0.8 and older caused by host key verification being disabled by default in several classes (AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, Ans...
CVE-2018-1000149
A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that...
Multiple Unify Product Information Disclosure Vulnerabilities
The Unify OpenStage 60 and others are IP telephones from Unify USA. An information disclosure vulnerability exists in multiple Unify products that stems from the program's failure to use a unique X.509 certificate and SSH host key. A remote attacker could use this vulnerability to conduct a...
Man In The Middle (MitM)
paramiko is vulnerable to man-in-the-middle MitM attacks. These attacks are possible on the ssh client when gsskey=True, the server doesnt support gssapi-keyex and doesnt give any or no host key...
Man In The Middle (MitM)
paramiko is vulnerable to man-in-the-middle MitM attacks. These attacks are possible on the ssh client when gsskey=True, the server doesn't support gssapi-keyex and doesn't give any or no host key...
Hardcoded SSH Host Key Detection
Binary data 7281.pasl...
Barracuda WAF V360 Firmware 8.0.1.014 Support Tunnel Hijack Exploit
Barracuda WAF V360 with firmware 8.0.1.014 suffers from a support tunnel hijacking vulnerability. Title: Barracuda WAF Support Tunnel Hijack 1. Vulnerability Details Affected Vendor: Barracuda Affected Product: Web Application Firewall V360 Affected Version: Firmware v8.0.1.014 Platform: Embedded...
CVE-2017-5242: Nexpose/InsightVM Virtual Appliance Duplicate SSH Host Key
Today, Rapid7 is notifying Nexpose and InsightVM users of a vulnerability that affects certain virtual appliances. While this issue is relatively low severity, we want to make sure that our customers have all the information they need to make informed security decisions regarding their networks. ...
CVE-2017-3204
The Go SSH library x/crypto/ssh by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism...
DEBIAN-CVE-2017-3204
The Go SSH library x/crypto/ssh by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism...
CVE-2017-3204
The Go SSH library x/crypto/ssh by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism...
UBUNTU-CVE-2017-3204
The Go SSH library x/crypto/ssh by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism...
CVE-2017-3204
The Go SSH library x/crypto/ssh by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism...
PT-2017-4225 · Go · Golang.Org/X/Crypto/Ssh
Name of the Vulnerable Software and Affected Versions: golang.org/x/crypto/ssh versions prior to the version that includes commit e4e2799 Description: The issue is related to the default behavior of the Go SSH library, which does not verify host keys. This facilitates man-in-the-middle attacks if...
SUSE-SU-2017:0607-3 Security update for openssh
This update for openssh fixes the following issues: - CVE-2016-8858: prevent resource depletion during key exchange bsc1005480 - CVE-2016-10009: limit directories for loading PKCS11 modules to avoid privilege escalation bsc1016366 - CVE-2016-10011: Prevent possible leaks of host private keys to...
SUSE-SU-2017:0606-1 Security update for openssh
This update for openssh fixes the following issues: Security issues fixed: - CVE-2016-8858: prevent resource depletion during key exchange bsc1005480 - CVE-2016-10009: limit directories for loading PKCS11 modules to avoid privilege escalation bsc1016366 - CVE-2016-10011: Prevent possible leaks of...
SUSE-SU-2017:0603-1 Security update for openssh
This update for openssh fixes the following issues: Security issues fixed: - CVE-2016-8858: prevent resource depletion during key exchange bsc1005480 - CVE-2016-10009: limit directories for loading PKCS11 modules to avoid privilege escalation bsc1016366 - CVE-2016-10011: Prevent possible leaks of...