CVE-2016-3702

Padding oracle flaw in CloudForms Management Engine aka CFME 5 allows remote attackers to obtain sensitive cleartext information...

CVE-2016-3702

Padding oracle flaw in CloudForms Management Engine aka CFME 5 allows remote attackers to obtain sensitive cleartext information...

CVE-2016-3702

Padding oracle flaw in CloudForms Management Engine aka CFME 5 allows remote attackers to obtain sensitive cleartext information...

CVE-2016-3702

CVE-2016-3702: Padding oracle flaw in Red Hat CloudForms Management Engine (CFME) 5 enables remote attackers to obtain sensitive cleartext information. Affected component and exact root cause are described as a padding oracle vulnerability; no specific exploit details or remediation are provided ...

CVE-2016-3702: Exposure of Sensitive Information to an Unauthorized Actor

Padding oracle flaw in CloudForms Management Engine aka CFME 5 allows remote attackers to obtain sensitive cleartext information...

PT-2017-8412

Name of the Vulnerable Software and Affected Versions CloudForms Management Engine CFME version 5 Description A padding oracle flaw allows remote attackers to obtain sensitive cleartext information. Recommendations For CloudForms Management Engine CFME version 5, at the moment, there is no...

httpd, mod_ldap, mod_proxy_html, mod_session, mod_ssl security update

CentOS Errata and Security Advisory CESA-2017:0906 An update for httpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

PT-2017-4230

Name of the Vulnerable Software and Affected Versions Nimbus JOSE+JWT versions prior to 4.39 Description The issue is related to the improper handling of an invalid HMAC in authenticated AES-CBC decryption, allowing attackers to conduct a padding oracle attack. This is due to a lack of integrity...

OpenSSH < 7.5

According to its banner, the version of OpenSSH running on the remote host is prior to 7.5. It is, therefore, affected by an information disclosure vulnerability : - An unspecified timing flaw exists in the CBC padding oracle countermeasures, within the ssh and sshd functions, that allows an...

httpd: Padding Oracle in Apache mod_session_crypto

It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack...

Code injection

botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites...

CVE-2015-7824

botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites...

CVE-2015-7824

botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites...

CVE-2015-7824

botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites...

CVE-2015-7824

Botan 1.11.x prior to 1.11.22 is vulnerable to a padding-oracle attack that makes it easier for remote attackers to decrypt TLS ciphertext when using TLS CBC ciphersuites. This is a remote/network issue affecting the Botan cryptographic library; exploitation is contingent on using an affected 1.1...

CVE-2015-7824: Exposure of Sensitive Information to an Unauthorized Actor

botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites...

PT-2017-7276

Name of the Vulnerable Software and Affected Versions botan versions 1.11.x through 1.11.21 Description The issue makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites. Recommendations For botan versions 1.11.x through 1.11.21...

CVE-2014-9934

A PKCS1 v1.5 signature verification routine in all Android releases from CAF using the Linux kernel may not check padding...

Phabricator: Phabricator is vulnerable to padding oracle attacks and chosen-ciphertext attacks.

Dear Phabricator bug bounty team, Summary --- Phabricator encrypts data with AES in CBC mode, but does not ensure integrity of the encrypted data. You must authenticate the data, by either using an HMAC or by using an authenticated block cipher mode like GCM. Why does this vulnerability exist? --...

PT-2017-9960

Name of the Vulnerable Software and Affected Versions go-jose versions prior to 1.0.5 Description The issue concerns an integer overflow in CBC-HMAC on 32-bit architectures, potentially leading to authentication bypass for CBC-HMAC encrypted ciphertexts. On 32-bit platforms, an attacker can...