Mandriva Linux Security Advisory : nss (MDVSA-2013:270)

Multiple security issues was identified and fixed in mozilla NSPR and NSS : Mozilla Network Security Services NSS before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified othe...

GLSA-201311-13 : OpenVPN: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201311-13 OpenVPN: Multiple vulnerabilities Multiple vulnerabilities have been discovered in OpenVPN. Please review the CVE identifiers referenced below for details. Impact : A remote attacker may be able to recover plaintext from...

Updated firefox, rootcerts, nspr & nss packages fix security vulnerabilities

Updated nspr and nss packages fix security vulnerabilities: Potentially exploitable buffer overflow in NSS before 3.15.3 that allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets CVE-2013-5605. The CERTVerifyCert function in...

Cupid Media Hacked, Plaintext Passwords Stolen

Hackers reportedly breached servers in January belonging to Cupid Media, a niche dating service with 30 million users, stealing more than 42 million unencrypted passwords and various other sensitive data. Cupid Media operates a variety of niche dating sites based on ethnicity, religion, physical...

OpenVPN: Multiple vulnerabilities

Background OpenVPN is a multi-platform, full-featured SSL VPN solution. Description Multiple vulnerabilities have been discovered in OpenVPN. Please review the CVE identifiers referenced below for details. Impact A remote attacker may be able to recover plaintext from an encrypted communication...

ARRIS DG860A NVRAM Backup Password Disclosure

Exploit for hardware platform in category web applications ! /usr/bin/env ruby ARRIS DG860A NVRAM Backup 'Compressor/Decompressor', it really does xor? Gleaned from scmix executable in firmware dump. Backup file is world readable without authentication and contains password information in plain...

GLSA-201310-18 : GnuTLS: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201310-18 GnuTLS: Multiple vulnerabilities Multiple vulnerabilities have been discovered in GnuTLS. Please review the CVE identifiers and Lucky Thirteen research paper referenced below for details. Impact : A remote attacker could...

GnuTLS: Multiple vulnerabilities

Background GnuTLS is an Open Source implementation of the TLS 1.2 and SSL 3.0 protocols. Description Multiple vulnerabilities have been discovered in GnuTLS. Please review the CVE identifiers and Lucky Thirteen research paper referenced below for details. Impact A remote attacker could sent a...

CVE-2013-5181

The auto-configuration feature in Mail in Apple Mac OS X before 10.9 selects plaintext authentication for unspecified servers that support CRAM-MD5 authentication, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2013-4293

The server in Red Hat JBoss Operations Network JON 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files...

Authentication flaw

The auto-configuration feature in Mail in Apple Mac OS X before 10.9 selects plaintext authentication for unspecified servers that support CRAM-MD5 authentication, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2013-5181

Apple Mac OS X Mail’s auto-configuration (pre-10.9) may select plaintext authentication for servers that support CRAM-MD5, enabling remote sniffing of credentials. Affected: OS X Mail before 10.9. Root cause: plaintext auth chosen during auto-config. Impact: potential exposure of sensitive inform...

CVE-2013-4293

The server in Red Hat JBoss Operations Network JON 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files...

CVE-2013-4293

CVE-2013-4293 affects Red Hat JBoss Operations Network (JON) 3.1.2. The server stores passwords in plaintext in log files, enabling a local attacker with log access to obtain sensitive credentials. This is a local, file-based disclosure vulnerability. The Red Hat advisory RHSA-2013:1448 notes a s...

SSL/TLS: CBC padding timing attack (lucky-13)

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct...

Server: Plaintext passwords in server logs

The server in Red Hat JBoss Operations Network JON 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files...

[slackware-security] gnutls

New gnutls packages are available for Slackware 12.1, 12.2, 13.0, 13.1, and 13.37 to fix security issues. Here are the details from the Slackware 13.37 ChangeLog: patches/packages/gnutls-2.10.5-i486-2slack13.37.txz: Rebuilt. Updated to the correct version to fix fetching the "latest" from gnu.org...

Cisco Prime Central for HCS Portal Credentials Access Vulnerability

A vulnerability in Cisco Prime Central for HCS portal could allow an authenticated, local attacker to retrieve the credentials for accounts. The vulnerability is due to plaintext logging of credentials to temporary files with inadequate permissions. An attacker could exploit this vulnerability by...

WhatsApp Crypto Implementation Vulnerability Discovered

WhatsApp, a popular mobile message application, suffers from crypto implementation vulnerability that leaves messages exposed. Thijs Alkemade, a computer science student at Utrecht University in The Netherlands who works on the open source Adium instant messaging project, disclosed a serious issu...

Opolis.eu Secure Mail Blind SQL Injection / XSS / CSRF / DoS

Opolis.eu suffers from cross site request forgery, cross site scripting, denial of service, and remote blind SQL injection vulnerabilities. The vendor has not responded to the researchers reports of these issues...