openSUSE Security Update : openssl (openSUSE-SU-2013:0337-1)

openssl was updated to 1.0.1e, fixing bugs and security issues : o Fix renegotiation in TLS 1.1, 1.2 by using the correct TLS version. o Include the fips configuration module. o Fix OCSP bad key DoS attack CVE-2013-0166 bnc802746 o Fix for SSL/TLS/DTLS CBC plaintext recovery attack CVE-2013-0169...

openSUSE Security Update : libopenssl-devel (openSUSE-SU-2012:0083-1)

Various security vulnerabilities have been fixed in openssl : - DTLS plaintext recovery attack CVE-2011-4108 - uninitialized SSL 3.0 padding CVE-2011-4576 - malformed RFC 3779 data can cause assertion failures CVE-2011-4577 - SGC restart DoS attack CVE-2011-4619 - invalid GOST parameters DoS atta...

openSUSE Security Update : nss-201112 (openSUSE-SU-2012:0030-1) (BEAST)

The Mozilla NSS libraries were updated to version 3.13.1 to fix various bugs and security problems. Following security issues were fixed: dbg114-nss-201112-5564 newupdateinfo nss-201112-5564 SSL 2.0 is disabled by default dbg114-nss-201112-5564 newupdateinfo nss-201112-5564 A defense against the...

openSUSE Security Update : openssl (openSUSE-SU-2013:1630-1)

This update disables compression in openssl by default, as the varying sizes resulting from compression can be used to retrieve plaintext in various cases. CRIME attack CVE-2012-4929. This update introduces a environment variable OPENSSLNODEFAULTZLIB which can be set to 'no' to reenable compressi...

openSUSE Security Update : openssl (openSUSE-2012-52)

openssl was prone to several security issues : - DTLS Plaintext Recovery Attack CVE-2011-4108 - Uninitialized SSL 3.0 Padding CVE-2011-4576 - Malformed RFC 3779 Data Can Cause Assertion Failures CVE-2011-4577 - SGC Restart DoS Attack CVE-2011-4619 - Invalid GOST parameters DoS Attack CVE-2012-002...

Crowd User Directory application password stored in plain text

Table: cwddirectoryattribute Column: attributevalue How to Verify in my environment: Connect to JIRA database using psql and run query: code select attributevalue from cwddirectoryattribute where attributename = 'application.password' code Note how the returned value is the plain text value of th...

NetGear DGN2200 N300无线路由器多个漏洞

Title: Multiple vulnerabilities in NETGEAR N300 WIRELESS ADSL2+ MODEM ROUTER DGN2200 ==================================================================================== Notification Date: 11 February 2014 Affected Vendor: NetGear Affected Hardware: NetGear DGN2200 N300 Wireless ADSL2+ Modem Rout...

BTC China operations improper random user plaintext password leak-vulnerability warning-the black bar safety net

OpenSSL“heartbleed”vulnerability https://vip.btcchina.com ! !...

eBay Password Database Hack Raises Questions

As is the case with most high-profile data breaches, despite an initial disclosure of information, more questions are inevitable. The eBay password database hack is a prime example. Inquiring minds still want to know more about how the stolen passwords are secured and why the online auction house...

CVE-2013-7385

LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which allows remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an...

CVE-2013-6806

OpenText Exceed OnDemand EoD 8 allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via a crafted string in a response, which triggers a downgrade to simple authentication that sends credentials in plaintext...

CVE-2013-7033

LiveZilla before 5.1.2.1 includes the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which might allow remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent...

Cross site scripting

LiveZilla before 5.1.2.1 includes the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which might allow remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent...

Authentication flaw

OpenText Exceed OnDemand EoD 8 allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via a crafted string in a response, which triggers a downgrade to simple authentication that sends credentials in plaintext...

CVE-2013-7033

LiveZilla before 5.1.2.1 includes the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which might allow remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent...

CVE-2013-7033

CVE-2013-7033 affects LiveZilla prior to 5.1.2.1. The issue arises because the operator password is included in plaintext in Javascript generated by lz/mobile/chat.php, enabling an independent XSS to retrieve loginName and loginPassword and potentially gain privileges. Multiple sources (NVD, Red ...

CVE-2013-6806

The CVE-2013-6806 entry concerns OpenText Exceed OnDemand (EoD) 8. A crafted response string allows a man-in-the-middle to disable bidirectional authentication, triggering a downgrade to simple authentication and sending credentials in plaintext. The vulnerability is network-exploitable with medi...

CVE-2013-7385

Technical details about this CVE are not publicly available in the provided Connected documents. Monitor for updates.

Microsoft .NET Framework 'RC4' Information Disclosure Vulnerability (2960358)

This host is missing an important security update according to Microsoft Security Advisory 2960358. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Microsoft Giving .NET Users The Option to Shed RC4

Microsoft didn’t beat around the bush when it warned customers to stay away from the deprecated RC4 algorithm last fall. Now it’s giving those who use its .NET software framework an option to disable the cipher in Transport Layer Security TLS as well. In a security advisory issued on its Security...