613 matches found
CVE-2019-0021 Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear text
On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4...
CVE-2019-0021
Summary: Juniper ATP exposes secret CLI inputs (e.g., set mcm) by logging them in plaintext to /var/log/syslog, enabling a local authenticated user to view sensitive information. Affected versions: Juniper ATP 5.0 prior to 5.0.4. Root cause: sensitive command inputs are written to system logs ins...
Information Disclosure
ansible is vulnerable to information disclosure. The vulnerability exists in the user module when it passes the sshkeypassphrase value to the ssh-keygen executable as a parameter, allowing any user with access to the process list to retrieve the passphrase in cleartext...
Information Disclosure
katello is vulnerable to information disclosure attacks. The vulnerability exists as script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading the file...
SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2018:2812-1)
This update for nodejs8 to version 8.11.4 fixes the following issues : Security issues fixed : CVE-2018-12115: Fixed an out-of-bounds memory write in Buffer that could be used to write to memory outside of a Buffer's memory space buffer bsc1105019 Upgrade to OpenSSL 1.0.2p, which fixed : -...
ZTE Home Gateway ZXHN H168N 2.2 Access Control Bypass Vulnerability
ZTE Home Gateway ZXHN H168N suffers from multiple access bypass and information disclosure vulnerabilities. POC: CVE-2018-7357 and CVE-2018-7358 Disclaimer: This POC is for Educational Purposes , I would Not be responsible for any misuse of the information mentioned in this blog post +...
ZTE ZXHN H168N - Improper Access Restrictions
ZTE ZXHN H168N - Improper Access Restrictions POC: CVE-2018-7357 and CVE-2018-7358 Disclaimer: This POC is for Educational Purposes , I would Not be responsible for any misuse of the information mentioned in this blog post + Unauthenticated + Author: Usman Saeed usman at xc0re.net + Protocol: UPn...
ZTE ZXHN H168N - Improper Access Restrictions
POC: CVE-2018-7357 and CVE-2018-7358 Disclaimer: This POC is for Educational Purposes , I would Not be responsible for any misuse of the information mentioned in this blog post + Unauthenticated + Author: Usman Saeed usman at xc0re.net + Protocol: UPnP + Affected Harware/Software: Model name: ZXH...
Notepad3 1.0.2.350 - Denial of Service Exploit
Exploit for windows platform in category dos / poc Exploit Title: Notepad3 1.0.2.350 - Denial of Service PoC Exploit Author: Ihsan Sencan Vendor Homepage: http://www.rizonesoft.com/ Software Link: https://netix.dl.sourceforge.net/project/notepad3/Notepad3%20Build%20350/Notepad3-1.0.2.350.exe...
Debian DLA-1576-1 : ansible security update
It was discovered that there was a potential SSH passphrase disclosure vulnerability in the ansible configuration management system, The 'User' module leaked data that was passed as a parameter to the ssh-keygen1 utility, thus revealing any credentials in cleartext form in the global process list...
[SECURITY] [DLA 1576-1] ansible security update
Package : ansible Version : 1.7.2+dfsg-2+deb8u1 CVE ID : CVE-2018-16837 Debian Bug : 912297 It was discovered that there was a potential SSH passphrase disclosure vulnerability in the ansible configuration management system, The "User" module leaked data that was passed as a parameter to the...
Debian: Security Advisory (DLA-1576-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ansible: Information leak in "user" module
The User module in Ansible leaks any data which is passed on as a parameter to ssh-keygen. This could lead to undesirable situations such as passphrase credentials being passed as a parameter for the ssh-keygen executable, showing those credentials in clear text form for every user which have...
Ansible: Information leak in "user" module
The User module in Ansible leaks any data which is passed on as a parameter to ssh-keygen. This could lead to undesirable situations such as passphrase credentials being passed as a parameter for the ssh-keygen executable, showing those credentials in clear text form for every user which have...
Ansible: Information leak in "user" module
The User module in Ansible leaks any data which is passed on as a parameter to ssh-keygen. This could lead to undesirable situations such as passphrase credentials being passed as a parameter for the ssh-keygen executable, showing those credentials in clear text form for every user which have...
Security update for nodejs8 (moderate)
This update for nodejs8 to version 8.11.4 fixes the following issues: Security issues fixed: - CVE-2018-12115: Fixed an out-of-bounds memory write in Buffer that could be used to write to memory outside of a Buffer's memory space buffer bsc1105019 - Upgrade to OpenSSL 1.0.2p, which fixed: -...
CA Unified Infrastructure Management < 8.48 / 8.53 Multiple Vulnerabilities (CA20180829-02)
According to its self-reported version number from the CA Unified Infrastructure Management UIM application running on the remote host is prior to 8.48 or 8.53. It is, therefore, affected by multiple vulnerabilities : - A hardcoded secret key exists that could allow information disclosure...
CVE-2018-5389
The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline...
