Denial Of Service

Network Security Services NSS is vulnerable to denial of service DoS. The vulnerability is possible because of the flaw in the way NSS handles cryptographic data from the network, leading to an application crash or execution of arbitrary code with the permission of the user running the applicatio...

Authorization Bypass

openstack-neutron is vulnerable to authorization bypass. Neutron functionality includes internal firewall management between networks. Due to the relaxed nature of particular rules, it is possible for machines on the same layer 2 networks to forge non-IP traffic, such as ARP and DHCP requests and...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS attacks. The vulnerability exists as a use-after-free vulnerability in the ssl3HandleECDHServerKeyExchange function in Mozilla Network Security Services NSS before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS attacks. The vulnerability exists as the secasn1dparseleaf function in Mozilla Network Security Services NSS before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restrict...

Man-in-the-middle Attack

Network Security Services NSS is vulnerable to a man-in-the-middle attack. The attack exists because it fails in handling state transitions for the TLS state machine and skips handshake message, allowing a man-in-the-middle to decrypt all traffic...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS attacks. The vulnerability exists as the CERTDecodeCertPackage function in Mozilla Network Security Services NSS, as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5,...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS attacks. The vulnerability exists as the ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services NSS before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x...

Denial Of Service

Network Security Services NSS is vulnerable to denial of service. It exists due to the regression introduced by the fix for CVE-2013-1620 which does not properly check the data reading are initialized data, leading to a decryption failure and a TLS/SSL server crash...

Solaris 10 (sparc) : 152927-02

JavaSE 8: update 202 patch equivalent to JDK 8u202, 64bit. Date this patch was last updated by Sun : Jan/14/19 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid121179;...

Fedora 28 : kernel / kernel-headers / kernel-tools (2019-337484d88b)

The v4.19.14 stable update contains important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 28 : mingw-nettle (2019-01afc2352f)

Resolves CVE-2018-16869 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security...

Fedora 29 : mingw-nettle (2019-31015766d1)

Resolves CVE-2018-16869 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security...

Fedora 28 : gnutls (2019-24dc022a51)

Security fix for CVE-2018-16868 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2018-075)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 a...

Virtuozzo 7 : readykernel-patch (VZA-2018-088)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - Transforming an IPv6 socket to an IPv4 and then transforming it back to a listening socket could result in a kernel...

Fedora 28 : krb5 (2019-ac7e19b0c8)

Improve memset hygiene in one location. ---- Fix low-severity CVE-2018-20217 an authenticated user who can obtain a TGT using an older encryption type DES, DES3, or RC4 can cause an assertion failure in the KDC by sending an S4U2Self request. Note that Tenable Network Security has extracted the...

Detecting Insecure Cookies with Qualys Web Application Scanning

Cookies are ubiquitous in today's modern web applications. If an attacker can acquire a user's session cookie by exploiting a cross-site scripting XSS vulnerability, by sniffing an unencrypted HTTP connection, or by some other means, then they can potentially hijack a user's valid session...

SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:0049-1) (Spectre)

This update for java-170-openjdk to version 7u201 fixes the following issues : Security issues fixed : CVE-2018-3136: Manifest better support bsc1112142 CVE-2018-3139: Better HTTP Redirection bsc1112143 CVE-2018-3149: Enhance JNDI lookups bsc1112144 CVE-2018-3169: Improve field accesses bsc111214...

CVE-2018-16192

CVE-2018-16192 affects NEC Aterm WF1200CR and Aterm WG1200CR (firmware 1.1.1 and earlier / 1.0.1 and earlier). The connected sources confirm an information disclosure vulnerability exploitable by an attacker on the same network segment, exposing registered device information via unspecified vecto...

CVE-2018-16198

CVE-2018-16198 affects Toshiba Home gateway HEM-GW16A and HEM-GW26A (firmware 1.2.9 and earlier). The issue is described as hidden functionality (CWE-912) that allows an attacker on the same network segment to access a non-documented developer screen and perform operations on the device. NVD note...