Design/Logic Flaw

The CBC mode in the TLS protocol, as used in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and other products, allows remote web servers to obtain plaintext data by triggering multiple requests to a...

PT-2012-3612 · Microsoft · Windows Server 2003 +5

Name of the Vulnerable Software and Affected Versions: Microsoft Windows XP SP2 and SP3 Microsoft Windows Server 2003 SP2 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2, R2, and R2 SP1 Microsoft Windows 7 Gold and SP1 Description: The issue allows remote web servers to obtain...

RedHat Update for openssl RHSA-2012:0059-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CVE-2012-2678

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhasheduserpassword attribute...

CVE-2012-2678

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhasheduserpassword attribute...

CVE-2012-2746

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password...

CVE-2012-2678

CVE-2012-2678 affects 389-ds-base (also Red Hat Directory Server) before version 1.2.11.6. Per the description, after an LDAP user’s password is changed and before the server is reset, an attacker could remotely read the plaintext password via the unhashed#user#password attribute. This vulnerabil...

CVE-2012-2746

CVE-2012-2746 affects 389-ds-base/Red Hat Directory Server prior to 1.2.11.6: when an LDAP user password is changed and audit logging is enabled, the new password is saved to logs in plain text, permitting remote authenticated users to read it. Affected version note appears in multiple advisories...

CVE-2012-2678

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhasheduserpassword attribute...

CVE-2012-2678

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhasheduserpassword attribute...

RSA SecurIDs Get Cracked In 13 Minutes

RSA SecurIDs Get Cracked In 13 Minutes Major corporations, government agencies, and small businesses all hand out RSA SecurID fob keychains to employees so that they can log in to their systems for security reasons and If you're used to seeing a device like this on a daily basis, you probably...

rhds/389: plaintext password disclosure in audit log

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password...

rhds/389: plaintext password disclosure flaw

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhasheduserpassword attribute...

GLSA-201206-33 : Postfix: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201206-33 Postfix: Multiple vulnerabilities A vulnerability have been discovered in Postfix. Please review the CVE identifier referenced below for details. Impact : An attacker could perform a man-in-the-middle attack and inject...

RHEL 6 : 389-ds-base (RHSA-2012:0997)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0997 advisory. - rhds/389: plaintext password disclosure flaw CVE-2012-2678 - rhds/389: plaintext password disclosure in audit log CVE-2012-2746 Note that...

rhds/389: plaintext password disclosure flaw

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhasheduserpassword attribute...

Mac OS X FileVault Plaintext Password Logging

Plaintext passwords were discovered in a system log file. Mac OS X Lion release 10.7.3 enabled a debug logging feature that causes plaintext passwords to be logged to /var/log/secure.log on systems that use certain FileVault configurations. A local attacker in the admin group or an attacker with...

Apple Legacy filevault barn door...

As someone said here recently, carefully built crypto has a unfortunate tendency to consist of three thick impregnable walls and a picket fence in the back with the gate left open. That seems to have happened to Apple's older "legacy" Filevault in the current release of MacOX Lion 10.7.3...

Flaw in OS X Lion Encryption Leaves User Credentials in Plaintext

There’s a serious weakness in certain versions of Apple OS X that causes the operating system to store users’ login credentials for the FileVault encrypted storage in plaintext. The bug, which is found in older versions of FileVault present on OS X Lion 10.7.3 systems, enables anyone with admin...

Lynx Message Server - Multiple Vulnerabilities

Lynx Message Server - Multiple Vulnerabilities 1. Summary The Micro Technology Services Inc. "Lynx Message Server 7.11.10.2" and/or "LynxTCPService version 1.1.62" web interface is vulnerable to SQL Injection, Cross-Site Scripting, and other security problems. 2. Description Lynx is a "Facility...