Check_MK 1.2.8p25 - Information Disclosure

CheckMK 1.2.8p25 - Information Disclosure 1. ADVISORY INFORMATION ======================= Product: Checkmk Vendor URL: https://mathias-kettner.de/checkmk.html Type: Race Condition CWE-362 Date found: 2017-09-21 Date published: 2017-10-18 CVSSv3 Score: 7.5...

F5 Networks BIG-IP : OpenSSH vulnerability (K14845276)

When SSHD tries to authenticate a non-existing user, it will pick up a fake password structure hard-coded in the SSHD source code. An attacker can measure timing information to determine if a user exists when verifying a password. CVE-2016-6210 C Tenable Network Security, Inc. The descriptive tex...

Ubuntu 14.04 LTS / 16.04 LTS : OpenSSH vulnerabilities (USN-3061-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3061-1 advisory. Eddie Harari discovered that OpenSSH incorrectly handled password hashing when authenticating non-existing users. A remote attacker could...

New Relic: User enumeration possible from log-in timing difference

Logging in with a username that already has an account takes longer to process than a username that does not have an account. This can be used to see if a given e-mail has a NewRelic account, and in turn can be used to enumerate all accounts on NewRelic. With an e-mail that already exists, the ti...

HTTP SERVER (httpsv1.6.2) 404 Denial of Service

No description provided by source. !/usr/bin/perl GetOpt STD module use IO::Socket; use Getopt::Std; getopts":i:p:",%args; ifdefined $argsi $ip = $argsi; ifdefined $argsp $port = $argsp; if!defined $argsi or !defined $argsp print "-----------------------------------------------------\n"; print...

DSA-1056-1 webcalendar - verbose error message

Bulletin has no description...

Inicom networks ioFTPd FTP Server account enumeration

Error messages differ for existant and non-existant user account...

CVE-2004-1174: Undefined Security Weakness

direntry.c in Midnight Commander mc 4.5.55 and earlier allows attackers to cause a denial of service by "manipulating non-existing file handles."...