9130 matches found
GnuTLS: Multiple vulnerabilities
Background GnuTLS is an Open Source implementation of the TLS 1.2 and SSL 3.0 protocols. Description Multiple vulnerabilities have been discovered in GnuTLS. Please review the CVE identifiers and Lucky Thirteen research paper referenced below for details. Impact A remote attacker could sent a...
CVE-2013-5181
The auto-configuration feature in Mail in Apple Mac OS X before 10.9 selects plaintext authentication for unspecified servers that support CRAM-MD5 authentication, which allows remote attackers to obtain sensitive information by sniffing the network...
CVE-2013-4293
The server in Red Hat JBoss Operations Network JON 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files...
Authentication flaw
The auto-configuration feature in Mail in Apple Mac OS X before 10.9 selects plaintext authentication for unspecified servers that support CRAM-MD5 authentication, which allows remote attackers to obtain sensitive information by sniffing the network...
CVE-2013-4293
CVE-2013-4293 affects Red Hat JBoss Operations Network (JON) 3.1.2. The server stores passwords in plaintext in log files, enabling a local attacker with log access to obtain sensitive credentials. This is a local, file-based disclosure vulnerability. The Red Hat advisory RHSA-2013:1448 notes a s...
CVE-2013-5181
Apple Mac OS X Mail’s auto-configuration (pre-10.9) may select plaintext authentication for servers that support CRAM-MD5, enabling remote sniffing of credentials. Affected: OS X Mail before 10.9. Root cause: plaintext auth chosen during auto-config. Impact: potential exposure of sensitive inform...
CVE-2013-4293
The server in Red Hat JBoss Operations Network JON 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files...
SSL/TLS: CBC padding timing attack (lucky-13)
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct...
Server: Plaintext passwords in server logs
The server in Red Hat JBoss Operations Network JON 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files...
[slackware-security] gnutls
New gnutls packages are available for Slackware 12.1, 12.2, 13.0, 13.1, and 13.37 to fix security issues. Here are the details from the Slackware 13.37 ChangeLog: patches/packages/gnutls-2.10.5-i486-2slack13.37.txz: Rebuilt. Updated to the correct version to fix fetching the "latest" from gnu.org...
Cisco Prime Central for HCS Portal Credentials Access Vulnerability
A vulnerability in Cisco Prime Central for HCS portal could allow an authenticated, local attacker to retrieve the credentials for accounts. The vulnerability is due to plaintext logging of credentials to temporary files with inadequate permissions. An attacker could exploit this vulnerability by...
WhatsApp Crypto Implementation Vulnerability Discovered
WhatsApp, a popular mobile message application, suffers from crypto implementation vulnerability that leaves messages exposed. Thijs Alkemade, a computer science student at Utrecht University in The Netherlands who works on the open source Adium instant messaging project, disclosed a serious issu...
Opolis.eu Secure Mail Blind SQL Injection / XSS / CSRF / DoS
Opolis.eu suffers from cross site request forgery, cross site scripting, denial of service, and remote blind SQL injection vulnerabilities. The vendor has not responded to the researchers reports of these issues...
PT-2013-90: Unauthorized Access in Emerson DeltaV
The specialists of the Positive Research center have detected an Unauthorized Access vulnerability in Emerson DeltaV. A Local attacker with user privileges can read configuration file to obtain sensitive information. User name and password for the DeltaVAdmin account are stored in plaintext. How ...
Vulnerability in aescrypt because IV is not randomized
The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack...
Updated polarssl package fixes security vulnerabilities
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in PolarSSL before 1.2.6, does not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and...
Passwords from variables are visible in plaintext in release versioning preview
Hey Atlassians! You can see the contents of masked variables the ones with "password" in their key when you click on "Add variable to version" in release versioning configuration screen for deployment project. Steps to reproduce: 1. Create a global variable with key: "testpassword" and value "abc...
Passwords from variables are visible in plaintext in release versioning preview
Hey Atlassians! You can see the contents of masked variables the ones with "password" in their key when you click on "Add variable to version" in release versioning configuration screen for deployment project. Steps to reproduce: 1. Create a global variable with key: "testpassword" and value "abc...
Junos Pulse Secure IVE / UAC OS Multiple SSL Vulnerabilities
According to its self-reported version, the version of IVE / UAC OS running on the remote host may be affected by multiple vulnerabilities : - Remote attackers may be able to trigger buffer overflow vulnerabilities on the OpenSSL libraries by sending specially crafted DER data, resulting in memor...
Amazon Linux AMI : openssl (ALAS-2013-171)
It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL or DTLS server as a paddi...