PT-2018-3408 · Dovecot +3 · Dovecot +3

Name of the Vulnerable Software and Affected Versions: dovecot versions prior to 2.2.34 Description: A denial of service flaw was found in the TLS SNI configuration lookups of the Dovecot mail server. An attacker able to generate random SNI server names could exploit this issue, leading to...

UBUNTU-CVE-2017-15130

A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage and the process to restart...

erlang: TLS server vulnerable to Adaptive Chosen Ciphertext attack allowing plaintext recovery or MITM attack

An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA. This may result in plain-text recovery of encrypted messages and/or a man-in-the-middle MiTM attack, despite the attacker not...

LINE for iOS Man-in-the-Middle Attack Vulnerability

LINE for iOS is a suite of live chat software based on the iOS platform. The program supports free calls, sending SMS and more. A security vulnerability exists in LINE versions 7.1.3 to 7.1.5, which is caused by the program failing to validate the SSL server's X.509 certificate. The vulnerability...

CVE-2018-5762

The TLS implementation in the TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 58.1 before 58.160, 59.1 before 059.1a.17 IC 17, and 60.0 before 60.044 might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT...

Wireshark epan/dissectors/packet-lltd.c file denial of service vulnerability

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A security vulnerability exists in the epan/dissectors/packet-lltd.c file in Wireshark...

Artifex Software MuPDF 'count_entries' function stack buffer overflow vulnerability

Artifex Software MuPDF is a PDF library from Artifex Software, USA. A security vulnerability exists in the 'countentries' function in the pdf-layer.c file in Artifex Software MuPDF version 1.10a. A remote attacker can exploit this vulnerability to cause a denial of service stack consumption and...

UBUNTU-CVE-2012-6709

ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation...

PT-2018-4061 · Elinks +2 · Elinks +2

Name of the Vulnerable Software and Affected Versions: ELinks version 0.12 Twibright Links version 2.3 Description: The issue is related to missing SSL certificate validation. Recommendations: For ELinks version 0.12, update to a version that includes proper SSL certificate validation. For...

Debian DSA-4120-1 : linux - security update (Meltdown) (Spectre)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. - CVE-2017-5715 Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker...

DEBIAN-CVE-2018-7286

An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. respjsip allows remote authenticated users to crash Asterisk segmentation fault by sending a number of SIP INVITE messages on a TCP or TLS connection and...

How to use NetScaler appliance to avoid Layer 7 DDoS attacks

This article describes how to use a NetScaler appliance to avoid layer 7 DDoS attacks when there is no dedicated device to protect from DDoS attacks...

Tejari Cross Site Request Forgery

----------------------------------------------------- Vulnerability Type: Cross Site Request Forgery CSRF Vendor of Product: Tejari Affected Product Code Base: Bravo Solution Affected Component: Web Interface Management. Attack Type: Local - Authenticated Impact: Unauthorised Access...

erlang: TLS server vulnerable to Adaptive Chosen Ciphertext attack allowing plaintext recovery or MITM attack

An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA. This may result in plain-text recovery of encrypted messages and/or a man-in-the-middle MiTM attack, despite the attacker not...

UBUNTU-CVE-2018-0488

ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service heap corruption via a crafted application packet within a TLS or DTLS session...

ALPINE-CVE-2018-0487

ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session...

CVE-2017-9968

A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning during the TLS/SSL connection establishing process can result in a man-in-the-middle attack...

Can't import Gold VM into App Layering, it says "The virtual machine template cannot have any attached disks."

You are trying to import a new Gold VM to be an OS layer. The first thing you need to do is create a Connector. In the Connector, you see the field for Template, and you try to select your Gold VM there. When you test it, it fails saying one of these: "The virtual machine template cannot have any...

Vobot Clock Information Disclosure Vulnerability

The Vobot Clock is a smart bedside alarm clock equipped with Amazon Alexa, Sleep Coach and Daily Routine programs. An information disclosure vulnerability exists in VOBOT CLOCK versions prior to 0.99.30. The vulnerability arises because the Vobot firmware does not validate the certificate of the...

The vulnerability of the VPN Secure Sockets Layer (SSL) function of the microprogramming network interface device in Cisco Adaptive Security Appliance (ASA) allows a hacker to execute arbitrary code and gain full control over the system.

The vulnerability of the VPN Secure Sockets Layer SSL function of the microprogramming network interface device in Cisco Adaptive Security Appliance ASA is related to a memory reclamation error. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code and gain...