CVE-2016-4379

The TLS implementation in HPE Integrated Lights-Out 3 aka iLO3 firmware before 1.88 does not properly use a MAC protection mechanism in conjunction with CBC padding, which allows remote attackers to obtain sensitive information via a padding-oracle attack, aka a Vaudenay attack...

Design/Logic Flaw

The TLS implementation in HPE Integrated Lights-Out 3 aka iLO3 firmware before 1.88 does not properly use a MAC protection mechanism in conjunction with CBC padding, which allows remote attackers to obtain sensitive information via a padding-oracle attack, aka a Vaudenay attack...

CVE-2016-4379

The TLS implementation in HPE Integrated Lights-Out 3 aka iLO3 firmware before 1.88 does not properly use a MAC protection mechanism in conjunction with CBC padding, which allows remote attackers to obtain sensitive information via a padding-oracle attack, aka a Vaudenay attack...

Jose-php Information Disclosure Vulnerability

jose-php is suitable for PHP JSON object signature and encryption library . A security vulnerability exists in versions of jose-php before 2.2.1, due to the lack of a random padding mechanism in the implementation of the RSA 1.5 algorithm in the JWE.php/JOSEJWE class. A remote attacker can obtain...

HP Integrated Lights-Out Information Disclosure Vulnerability (CNVD-2016-07089)

HP Integrated Lights-Out is used for remote management of servers. An information disclosure vulnerability exists in HP Integrated Lights-Out. A remote attacker could exploit this vulnerability to cause information disclosure via TLS CBC Padding and MAC errors...

Updated phpmyadmin packages fix security vulnerability

In phpMyAdmin before 4.4.15.8, the decryption of the username/password is vulnerable to a padding oracle attack. The can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Also, the same initialization vector IV is used to hash the username and...

OpenSSH CBC Padding Weak Password Vulnerability

OpenSSH is a set of connection tools maintained by the OpenBSD Project Group for secure access to remote computers. A weak password vulnerability exists in OpenSSH CBC Padding, which allows an attacker to bypass security restrictions and obtain sensitive information...

phpMyAdmin 4.0.10.x < 4.0.10.17 / 4.4.15.x < 4.4.15.8 / 4.6.x < 4.6.4 Multiple Vulnerabilities

Binary data 9538.prm...

OpenSSH < 7.3 Multiple Vulnerabilities

According to its banner, the version of OpenSSH running on the remote host is prior to 7.3. It is, therefore, affected by multiple vulnerabilities : - A local privilege escalation when the UseLogin feature is enabled and PAM is configured to read .pamenvironment files from home directories...

OpenSSH 7.x < 7.3 Multiple Vulnerabilities

Binary data 9507.prm...

Oracle Secure Global Desktop Multiple Vulnerabilities (July 2016 CPU)

The version of Oracle Secure Global Desktop installed on the remote host is 4.63, 4.71, or 5.2 and is missing a security patch from the July 2016 Critical Patch Update CPU. It is, therefore, affected by the following vulnerabilities : - An integer overflow condition exists in the X Server...

Oracle VM VirtualBox < 5.0.22 Multiple Vulnerabilities (July 2016 CPU)

The Oracle VM VirtualBox application installed on the remote host is a version prior to 5.0.22. It is, therefore, affected by multiple vulnerabilities in the bundled OpenSSL component : - A heap buffer overflow condition exists in the EVPEncodeUpdate function within file crypto/evp/encode.c that ...

IDPS SandBox AntiVirus Stealth Killer: MorphAES

IDPS SandBox AntiVirus Stealth Killer MorphAES is the world’s first polymorphic shellcode/malware engine, with metamorphic properties and capability to bypass sandboxes, which makes it undetectable for an IDPS, it’s cross-platform as well and library-independent. Properties: Polymorphism AES...

Fedora 23 : php-ZendFramework2 / php-zendframework-zendxml (2016-8952105d59)

" 2.4.10 2016-05-09 - Fix HeaderValue throwing an exception on legal characters 2.4.9 2015-11-23 SECURITY UPDATES - ZF2015-09: Zend\Captcha\Word generates a 'word' for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this vulnerability announcement, the...

Cisco TelePresence VCS / Expressway 8.x < 8.8 Multiple Vulnerabilities (Bar Mitzvah)

According to its self-reported version, the Cisco TelePresence Video Communication Server VCS / Expressway running on the remote host is 8.x prior to 8.8. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists, known as Bar Mitzvah, due to improp...

Fedora 22 : php-ZendFramework2 / php-zendframework-zendxml (2016-03c0ed3127)

" 2.4.10 2016-05-09 - Fix HeaderValue throwing an exception on legal characters 2.4.9 2015-11-23 SECURITY UPDATES - ZF2015-09: Zend\Captcha\Word generates a 'word' for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this vulnerability announcement, the...

OpenSSL 1.0.1 < 1.0.1t / 1.0.2 < 1.0.2h Multiple Vulnerabilities

Binary data 9390.prm...

Weakness with cookie encryption

PMASA-2016-29 Announcement-ID: PMASA-2016-29 Date: 2016-07-07 Summary Weakness with cookie encryption Description A pair of vulnerabilities were found affecting the way cookies are stored. The decryption of the username/password is vulnerable to a padding oracle attack. The can allow an attacker...

The vulnerability of the Wireshark Network Protocol Analyzer software allows a remote attacker to compromise the accessibility of protected information.

A vulnerability exists in the dissectberconstrainedbitstring function in epan/dissectors/packet-ber.c within the ASN.1 BER dissector in Wireshark, due to incorrect checks on padding values. Exploiting this vulnerability allows malicious actors to cause service failures—such as insufficient buffer...

The vulnerability of Cisco IPS’ software allows a malicious individual to obtain a one-time code (nonce) for ECDSA encryption.

The vulnerability exists in the implementation of the Montgomery algorithm in OpenSSL, due to the temporal impermanence of the padding operations. Exploiting this vulnerability allows local users to obtain a one-time code nonce for ECDSA by attacking the cache through external channels using the...