1446 matches found
CVE-2015-8542
Open-Xchange Guard prior to 2.2.0-rev8 is affected. The getprivkeybyid API allows downloading a user’s PGP Private Key after authentication. The auth parameter contains a hashed password, used as a single point of authentication, and, because id and cid are sequential, an attacker can iterate the...
CVE-2015-8542
An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The "getprivkeybyid" API call is used to download a PGP Private Key for a specific user after providing authentication credentials. Clients provide the "id" and "cid" parameter to specify the current user by its user- and context-ID...
CVE-2016-6853
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites,...
CVE-2016-6854
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verifying the signature. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwant...
I'm giving up on PGP
After years of wrestling GnuPG with varying levels of enthusiasm, I came to the conclusion that it's just not worth it, and I'm giving up. At least on the concept of long term PGP keys. This is not about the gpg tool itself, or about tools at all. Many already wrote about that. It's about the lon...
About the security content of iTunes 12.5.2 for Windows
About the security content of iTunes 12.5.2 for Windows This document describes the security content of iTunes 12.5.2 for Windows. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patche...
About the security content of iOS 10.0.3 - Apple Support
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...
Open-Xchange Guard 2.4.2 - Multiple Cross-Site Scripting Vulnerabilities
Open-Xchange Guard 2.4.2 - Multiple Cross-Site Scripting Vulnerabilities Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed...
Open-Xchange Guard 2.4.2 Cross Site Scripting
Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.4.0-rev11, 2.4.2-rev5...
About the security content of iOS 10.0.1
About the security content of iOS 10.0.1 This document describes the security content of iOS 10.0.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
Open-Xchange Guard 2.4.2 - Multiple Cross Site Scripting
Exploit for linux platform in category web applications Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed Solution status: Fixed...
Open-Xchange Guard 2.4.2 - Multiple Cross-Site Scripting Vulnerabilities
Product: OX Guard Vendor: OX Software GmbH Internal reference: 47878 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 2.4.2 and earlier Vulnerable component: guard Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.4.0-rev11, 2.4.2-rev5...
ArcServe UDP 6.0.3792 Update 2 Build 516 - Unquoted Service Path Privilege Escalation
ArcServe UDP 6.0.3792 Update 2 Build 516 - Unquoted Service Path Privilege Escalation Title: ArcServe UDP - Unquoted Service Path Privilege Escalation CWE Class: CWE-427: Uncontrolled Search Path Element Date: 04/09/2016 Vendor: ArcServe Product: ArcServe UDP Standard Edition for Windows, TRIAL...
[SECURITY] [DLA 567-2] mysql-5.5 security and regression update
Package : mysql-5.5 Version : 5.5.50-0+deb7u2 CVE ID : CVE-2016-3477 CVE-2016-3521 CVE-2016-3615 CVE-2016-5440 Several vulnerabilities have been found in the MySQL Database Server. These vulnerabilities are addressed by upgrading MySQL to the recent upstream 5.5.50 version. Please refer to the...
Open-Xchange: OX (Guard): Stored Cross-Site Scripting via Incoming Email
Summary "OX Guard" introduces a Stored Cross-Site Scripting XSS vulnerability to the frontend. HTML/JS code can be injected into the frontend through an incoming email. Injected code will be executed = become part of the DOM the moment the victim opens the email. The vulnerability allows for...
About the security content of AirPort Base Station Firmware Update 7.6.7 and 7.7.7
About the security content of AirPort Base Station Firmware Update 7.6.7 and 7.7.7 This document describes the security content of AirPort Base Station Firmware Update 7.6.7 and 7.7.7. For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full...
Nextcloud: Directory Listing On download.nextcloud.com & Practical Attacks on PGP (Pretty Good Privacy)
Sir, I have found a major bug in your website : That Is Directory listing & Practical Attacks On PGP signature affected area https://download.nextcloud.com/server/ here is my poc F100081 Poc Details: The web server is configured to display the list of files contained in this directory. As a resul...
Apple hires Encryption Expert to Beef Up Security on its Devices
The FBI and other law enforcement agencies have waged legal war on encryption and privacy technologies. You may have heard many news stories about the legal battle between Apple and the FBI over unlocking an iPhone that belonged to the San Bernardino shooter. However, that was just one battle in ...
