10228 matches found
Blockwise Chosen-boundary Attacks
github.com/openshift/origin is vulnerable to blockwise chosen-boundary attacks aka the "BEAST" attack. It encrypts data by using CBC mode with chained initialization vectors which allows attackers to obtain plaintext HTTP headers through blockwise chosen-boundary attacks on HTTPS sessions. This...
U.S. Dept Of Defense: Multiple cryptographic vulnerabilities in login page on ███████
Summary: I realize that this report's title may not make sense yet. In one sentence: users logging in to the ███████ Server REST API Login page can have their passwords stolen by an attacker on the same LAN or WiFi as the victim trying to log in. Description: To save the reader any confusion, I'l...
cluthaprint.co.nz XSS vulnerability
Vulnerable URL: https://www.cluthaprint.co.nz/cart.php?id=9=0=8"';--=add\n Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 21398161 VIP website status:| No Check cluthaprint.co.nz S...
CVE-2017-3518
Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control subcomponent: Discovery Framework. Supported versions that are affected are 12.1.0, 13.1.0 and 13.2.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access v...
Code injection
Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control subcomponent: Discovery Framework. Supported versions that are affected are 12.1.0, 13.1.0 and 13.2.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access v...
CVE-2017-3499
Vulnerability in the Oracle Social Network component of Oracle Fusion Middleware subcomponent: Android Client. The supported version that is affected is prior to 11.1.12.0.0 17019101. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTPS to compromise...
CVE-2017-3499
CVE-2017-3499 affects Oracle Fusion Middleware’s Oracle Social Network Android Client (prior to 11.1.12.0.0). It is exploitable over HTTPS by an unauthenticated, network-accessing attacker, potentially leading to unauthorized access to confidential Oracle Social Network data. Root cause and speci...
PT-2017-15935
Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions prior to 11.1.12.0.0 Description The issue allows an unauthenticated attacker with network access via HTTPS to compromise Oracle Social Network, resulting in unauthorized access to critical data or complete...
PT-2017-15954
Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Grid Control versions 12.1.0, 13.1.0, and 13.2.0 Description The issue allows an unauthenticated attacker with network access via HTTPS to compromise the Enterprise Manager Base Platform, resulting in the ability to...
CVE-2017-3518: Undefined Security Weakness
Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Grid Control subcomponent: Discovery Framework. Supported versions that are affected are 12.1.0, 13.1.0 and 13.2.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access v...
Fedora 25 : php-pear-CAS (2017-2a90185a04)
Changes in version 1.3.5 - Security Fixes : - Fix possible authentication bypass in validateCAS20 228 Gregory Boddin - Bug Fixes : - Fix file permissions non-executable 177 Remi Collet - Fixed translations Greek and Japanese 192 ikari7789 - Fix errors under phpdbg 204 MasonM - Fix logout...
Fedora 24 : php-pear-CAS (2017-d9d620366e)
Changes in version 1.3.5 - Security Fixes : - Fix possible authentication bypass in validateCAS20 228 Gregory Boddin - Bug Fixes : - Fix file permissions non-executable 177 Remi Collet - Fixed translations Greek and Japanese 192 ikari7789 - Fix errors under phpdbg 204 MasonM - Fix logout...
CVE-2016-1518
The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have...
Session fixation
The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have...
Design/Logic Flaw
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application...
CVE-2016-1520
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application...
CVE-2016-1520
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application...
oppo.com XSS vulnerability
Vulnerable URL: http://www.oppo.com/my/supports/imei-check/checkimei.php?ino="--! Details: Description| Value ---|--- Patched:| Yes, at 21.09.2017 Latest check for patch:| 21.09.2017 01:13 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 9247 VIP website status:|...
CVE-2016-1520: Undefined Security Weakness
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application...
