ISC BIND Query Packet Cookie Option Denial of Service Vulnerability

ISC BIND is a set of open source software that implements the DNS protocol. BIND 9.10 provides native support for DNS cookies or user identification, a mechanism designed to protect the security of the query requestor and domain name servers when they interact. An attacker can maliciously constru...

DEBIAN-CVE-2016-0704

An oracle protection mechanism in the getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier fo...

DEBIAN-CVE-2016-0703

The getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to...

CVE-2016-0703

The getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to...

CVE-2016-0704

An oracle protection mechanism in the getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier fo...

OpenSSL Bleichenbacher oracle vulnerability

OpenSSL is an open source implementation of SSL used to enable strong encryption of network communications and is now widely used in a variety of web applications. OpenSSL 1.0.2, 1.0.1l, 1.0.0q, 0.9.8ze and earlier versions have a security vulnerability in export key combinations applying...

Vulnerability in OpenSSL - Bleichenbacher oracle in SSLv2

This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address the vulnerability CVE-2015-0293. s2srvr.c overwrite the wrong bytes in the master-key when applying Bleichenbacher protection for export cipher suites. This provides a...

CloudBees Jenkins CI and LTS Remote Code Execution Vulnerability

CloudBees Jenkins CI is a set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . LTS is a long-term support for CloudBees Jenkins CI version . A remot...

IBM InfoSphere Master Data Management Reference Data Management Cross-Site Scripting Vulnerability

IBM InfoSphere Master Data Management MDM is a suite of solutions from IBM in the U.S. used to help organizations manage enterprise-wide master data information about customers, suppliers, products, and accounts.Reference Data Management RDM is one of the reference Data Management component. A...

CVE-2015-7492

Cross-site scripting XSS vulnerability in Reference Data Management RDM in IBM InfoSphere Master Data Management 10.1, 11.0 before FP5, 11.3, 11.4, and 11.5 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in Reference Data Management RDM in IBM InfoSphere Master Data Management 10.1, 11.0 before FP5, 11.3, 11.4, and 11.5 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-7492

Cross-site scripting XSS vulnerability in Reference Data Management RDM in IBM InfoSphere Master Data Management 10.1, 11.0 before FP5, 11.3, 11.4, and 11.5 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-7492

IBM InfoSphere Master Data Management’s Reference Data Management (RDM) is affected by CVE-2015-7492 via improper validation of user-supplied input, enabling cross-site scripting through a specially crafted URL when authenticated remotely. Affected versions include IBM InfoSphere MDM/RDM 10.1, 11...

Paragon Initiative Enterprises: file full path discloser.

Hi, Paragonie security team i found one directory browsing vulnerability in php-encryption-master where the user input will not been filtered from any security layer. let me show you. there is a autoload.php page in the php-encryption-master. where the input src will b used to browse the director...

Error:"Office Licensing Rearm failed" while updating or creating new Machine Catalogs with MCS

Install Office 2010 / 2013 into Master Image for XenDesktop. Then, during the Machine Catalog update, the following error is displayed: "Office Licensing Rearm failed."...

DEBIAN-CVE-2015-8789

Use-after-free vulnerability in the EbmlMaster::Read function in libEBML before 1.3.3 allows context-dependent attackers to have unspecified impact via a "deeply nested element with infinite size" followed by another element of an upper level in an EBML document...

jenkins: JNLP slaves not subject to slave-to-master access control (SECURITY-206)

Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665...

jenkins: Combination filter Groovy script unsecured (SECURITY-125)

It was found that the combination filter Groovy script could allow a remote attacker to potentially execute arbitrary code on a Jenkins master...

Wireshark - dissect_nhdr_extopt Stack Based Buffer Overflow

Exploit for multiple platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=696 The following crash due to a stack-based buffer overflow can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...

Wireshark - dissect_ber_constrained_bitstring Heap Out-of-Bounds Read

Source: https://code.google.com/p/google-security-research/issues/detail?id=659 The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark -nVxr /path/to/file": --- cut ---...