Incorrect Key Verification

ansible is vulnerable to incorrect key verification. The library does not verify key fingerprints before uploading them. This allows a malicious user to generate a key with the desired 16 digit id and upload it to the server...

OPENSUSE-SU-2017:0790-1 Security update for mbedtls

This update to mbedtls 1.3.19 fixes security issues and bugs. The following vulnerability was fixed: CVE-2017-2784: A remote user could have used a specially crafted certificate to cause mbedtls to free a buffer allocated on the stack when verifying the validity of public key with a secp224k1...

[SECURITY] [DLA 775-1] hplip security update

Package : hplip Version : 3.12.6-3.1+deb7u2 CVE ID : CVE-2015-0839 Debian Bug : 787353 CVE-2015-0839 The hplip plugin download function verifies the driver using a short-key. This is not secure because it is trivial to generate keys with arbitrary key IDs. For Debian 7 "Wheezy", these problems ha...

CVE-2016-2053

The asn1berdecoder function in lib/asn1decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service panic via an ASN.1 BER file that lacks a public key, leading to mishandling by the publickeyverifysignature function in crypto/asymmetrickeys/publickey.c...

DEBIAN-CVE-2016-2053

The asn1berdecoder function in lib/asn1decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service panic via an ASN.1 BER file that lacks a public key, leading to mishandling by the publickeyverifysignature function in crypto/asymmetrickeys/publickey.c...

Petya of Salsa: a modified algorithm to bring the defect-vulnerability warning-the black bar safety net

Previously the Hubble analysis of the system describes about the modified MBR for disk encryption extortion Trojan Petya's. Recently Leo Stone gives crack Petya key full blasting code and decrypt tool, and noted that Petya author is using a variant of the Salsa20 algorithm to perform key...

WhatsApp turns on End-to-End Encryption by default for its 1 Billion Users

WhatsApp is updating its messaging app so that every text message and voice call will be encrypted for the company’s one billion users. Yes, Whatsapp has finally implemented full end-to-end encryption, as promised a year ago. This means, from now every message, image or voice call you made will b...

CVE-2015-7974

NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."...

CVE-2015-7974

NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."...

MS15-083: Vulnerability in Server Message Block could allow remote code execution: August 11, 2015

None None...

PT-2015-7893

Name of the Vulnerable Software and Affected Versions Qt Creator affected versions not specified Description The issue is related to Qt Creator not verifying SSH host keys when using the built-in SSH client. Recommendations At the moment, there is no information about a newer version that contain...

Fedora 21 : qt-creator-3.3.2-2.fc21 (2015-3574)

Add SSH host key verification to built-in SSH client. Update to version 3.3.2, see https://qt.gitorious.org/qt-creator/qt-creator/raw/2fb9c3c7abc93a9237e 72972ee222b2a2628007e:dist/changes-3.3.2 for details. Note that Tenable Network Security has extracted the preceding description block directly...

MS14-085: Vulnerability in Microsoft graphics component could allow information disclosure: December 9, 2014

None None...

MS14-076: Vulnerability in Internet Information Services (IIS) could allow security feature bypass: November 11, 2014

None None...

FreeBSD : PuTTY -- Four security holes in versions before 0.63 (4b448a96-ff73-11e2-b28d-080027ef73ec)

Simon Tatham reports : This 0.63 release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. ... These vulnerabilities can be triggered before host key verification, which means that you are not even saf...

PuTTY -- Four security holes in versions before 0.63

Simon Tatham reports: This 0.63 release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. ... These vulnerabilities can be triggered before host key verification, which means that you are not even safe...

JON: Unapproved agents can connect using the name of an existing approved agent

Red Hat JBoss Operations Network JON before 2.4.2 and 3.0.x before 3.0.1 does not check the JON agent key, which allows remote attackers to spoof the identity of arbitrary agents via the registered agent name...

putty -- buffer overflow vulnerability in ssh2 support

There is a bug in SSH2 support that allows a server to execute malicious code on a connecting PuTTY client. This attack can be performed before host key verification happens, so a different machine -- man in the middle attack -- could fake the machine you are connecting to...

Microsoft Windows SMB Registry : Remote PDC/BDC Detection

The remote host seems to be a Primary Domain Controller or a Backup Domain Controller. This can be verified by the value of the registry key 'ProductType' under 'HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions'. C Tenable Network Security, Inc. include"compat.inc"; if description...

Vulnerabilities in PuTTY and PSCP

Advisory ID Internal CORE-2004-0705 Bugtraq ID: 10850, 10870 CVE Name: None currently assigned. Title: Vulnerabilities in PuTTY and PSCP Class: Boundary Error Condition Remotely Exploitable: Yes Locally Exploitable: No Vendors contacted: - Maintainers of PuTTY . Core notification: 2004-07-28...