6201 matches found
CVE-2020-35284
Flamingo aka FlamingoIM through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product'...
Directory traversal
Flamingo aka FlamingoIM through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product'...
CVE-2020-35284
Flamingo aka FlamingoIM through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product'...
CVE-2020-35284
CVE-2020-35284 affects Flamingo (aka FlamingoIM). The vulnerability allows directory traversal (via ../) in file-transfer requests; the issue arises because the only ostensibly unpredictable part is an MD5 computation that runs on the client side, and the computation details can be inferred from ...
CVE-2020-35284: Improper Limitation of a Pathname to a Restricted Directory
Flamingo aka FlamingoIM through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product'...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Synergy (CVE-2016-0475 and CVE-2015-7575)
Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 15 and earlier releases that is used by Rational Synergy. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the...
OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS (Security, 8229951)
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Security. Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...
FreeBSD : glpi -- weak csrf tokens (b64edef7-3b10-11eb-af2a-080027dbe4b7)
MITRE Corporation reports : In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6. C Tenable Network Security, Inc. The...
IBM HTTP Server 8.5.0.0 <= 8.5.5.8 / 8.0.0.0 <= 8.0.0.12 Multiple Vulnerabilities (538705)
The version of IBM HTTP Server running on the remote host is affected by multiple vulnerabilities, as follows: - Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than...
[slackware-security] seamonkey
New seamonkey packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/seamonkey-2.53.5.1-i686-1slack14.2.txz: Upgraded. This update contains security fixes and improvements. For more information, see:...
GaussDB Kernel: Prohibiting host Entries from Using MD5 Authentication in the pg_hba.conf File
MD5 authentication is insecure. You are advised to use SHA256 authentication. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program i...
GaussDB Kernel: Configuring the Password Encryption Mode
GaussDB Kernel supports two password encryption modes: MD5 and SHA256. MD5 is an insecure encryption mode and should not be configured. This mode is reserved only for compatibility with open-source third-party tools. SHA256 default configuration should be used. Copyright C 2020 Greenbone Networks...
M/Monit 3.7.4 - Password Disclosure
Title: M/Monit 3.7.4 - Password Disclosure Author: Dolev Farhi Date: 2020-07-09 Vendor Homepage: https://mmonit.com/ Version : 3.7.4 import sys import requests url = 'http://youriphere:8080' username = 'test' password = 'test123' sess = requests.Session sess.gethost def login: print'Attempting to...
CVE-2020-17494
Untangle Firewall NG before 16.0 uses MD5 for passwords...
Design/Logic Flaw
Untangle Firewall NG before 16.0 uses MD5 for passwords...
CVE-2020-17494
Affected product: Untangle Firewall NG. Vulnerability: use of MD5 for passwords in versions before 16.0 (root cause: weak password hashing). Impact: knowledge of weak password storage; explicit exploitation details are not provided in the sources. Remediation: upgrade to version 16.0 or later (pe...
CVE-2020-17494
Untangle Firewall NG before 16.0 uses MD5 for passwords...
CVE-2020-17494: Inadequate Encryption Strength
Untangle Firewall NG before 16.0 uses MD5 for passwords...
openGauss: Prohibiting host Entries from Using MD5 Authentication in the pg_hba.conf File
MD5 authentication is insecure. You are advised to use SHA256 authentication. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program i...
new module: perl:5.30
An update is available for perl-Pod-Perldoc, perl-DBI, perl-Pod-Escapes, perl-Devel-PPPort, perl-Pod-Usage, perl-Sub-Exporter, perl-perlfaq, perl-Object-HashBase, perl-CPAN-Meta-YAML, perl-Digest, perl-podlators, perl-bignum, perl-Text-ParseWords, perl-Text-Template, perl-DBD-MySQL, perl-Text-Glo...