CVE-2017-7902

CVE-2017-7902 affects Rockwell Automation Allen‑Bradley MicroLogix 1100 (1763-L16Axx, 16.00 and earlier) and MicroLogix 1400 (1766-L32Axx, 16.00 and earlier). The issue is nonce reuse in encryption, enabling an attacker to capture and replay a valid request until the nonce changes, potentially co...

PT-2017-18850 · Chicken +1 · Chicken Scheme +1

Name of the Vulnerable Software and Affected Versions: CHICKEN Scheme versions prior to 4.13 Description: The issue arises from an incorrect "pair?" check in the Scheme "length" procedure, leading to an unsafe pointer dereference. This allows an attacker to cause a denial of service by passing an...

Ceragon FibeAir IP-10 - SSH Private Key Exposure Exploit

Exploit for linux platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'net/ssh' class MetasploitModule 'Ceragon FibeAir IP-10 SSH Private Key Exposure',...

How to Remove and Replace a NetScaler in High Availability (HA) Pair Setup

This article helps you address RMA replacements and includes instruction on how to backup configurations, upgrade or downgrade shipped software version, and setup of RPC password on NetScaler. Before you Begin Label all interfaces/cables prior to swap Requirements A Windows client or server with...

Confide Updates App After Critical Security Issues Are Raised

The makers of the popular messaging app Confide said Wednesday that it has patched multiple security vulnerabilities that could have allowed hackers to intercept messages sent using its secure end-to-end messaging platform. The flaws were identified in two separate reports, both released Wednesda...

Dr. Pair - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Dr. Pair published at the 'play' market has multiple vulnerabilities...

CVE-2015-6418

The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224...

Design/Logic Flaw

The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224...

CVE-2015-6418

CVE-2015-6418 concerns Cisco Small Business RV Series routers (4.x) and SA500 Security Appliances (2.2.07). The root cause is a weak random-number generator with insufficient entropy used during TLS handshake key exchange, enabling a remote attacker to potentially determine the TLS key pair from ...

Cisco Small Business RV Series and SA500 Series Dual WAN VPN Router Generated Key Pair Information Disclosure Vulnerability

A vulnerability in the HTTPS session key exchange process of certain Cisco Small Business RV Series Routers and Cisco SA500 Series Security Appliances could allow an unauthenticated, remote attacker to obtain the key pair used in the Transport Layer Security TLS session from the affected device...

CVE-2001-1473

The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a Session ID that matches the Session ID of the target, but which uses a public key pair that is weaker than the target's public key, which allows th...

CVE-2015-3221

OpenStack Neutron before 2014.2.4 juno and 2015.1.x before 2015.1.1 kilo, when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service L2 agent crash by adding an address pair that is rejected by the ipset tool...

CVE-2015-3221

OpenStack Neutron before 2014.2.4 juno and 2015.1.x before 2015.1.1 kilo, when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service L2 agent crash by adding an address pair that is rejected by the ipset tool...

Node.js 'V8 utf-8 decoder' DoS Vulnerability - Windows

Node.js is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodejs:node.js";...

Bug in OpenSSH Opens Linux Machines to Password Cracking Attack

A simple but highly critical vulnerability recently disclosed in the most widely used OpenSSH software allows attackers to try thousands of password login attempts per connection in a short period. OpenSSH is the most popular software widely used for secure remote access to Linux-based systems...

CVE-2015-5380

CVE-2015-5380 affects Google V8 (as used by Node.js and io.js) where Utf8DecoderBase::WriteUtf16Slow may not verify memory for a UTF-16 surrogate pair. This can enable a remote attacker to trigger denial of service via a crafted byte sequence, potentially causing memory corruption. Affected versi...

So, you wanna crypto (in AEM)

So another year passed by and I will talk again , ... at the Connect WE conference. This year with Damien Antipa we will have a speech entitled So, you wanna crypto in AEM . Now, is true that even symmetric encryption isn't a “solved problem” but hey we still need to protect information et al : N...

Ceragon FibeAir IP-10 SSH Private Key Exposure

Ceragon FibeAir IP-10 SSH Private Key Exposure CVE-2015-0936 Product Description Ceragon produces a series of ruggedized, microwave backhaul devices used to provide connectivity to mobile, IP-based devices; usually, these devices are found in either large industrial environments, or installed on...

Quantum DXi V1000 SSH Private Key Exposure

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'net/ssh' class Metasploit3 'Quantum DXi V1000 SSH Private Key Exposure', 'Description' = %q Quantum ships a public/private key pair on DXi V100...

CVE-2011-4610

JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service infinite loop via vectors related to a crafted UTF-8 and a...