SUSE-SU-2017:1661-1 Security update for openssh-openssl1

This update for openssh-openssl1 fixes the following issues: - Properly verify CIDR masks in configuration bsc1005893 - CVE-2016-10009: limit directories for loading PKCS11 modules bsc1016366 - CVE-2016-10011: Prevent possible leaks of host private keys to low-privilege process handling...

GLSA-201706-21 : nettle: Information disclosure

The remote host is affected by the vulnerability described in GLSA-201706-21 nettle: Information disclosure It was found that nettles RSA and DSA decryption code was vulnerable to cache-related side channel attacks. See the referenced technical paper Cache Attacks Enable Bulk Key Recovery on the...

Missing Certificate Request Signature Validation

crypto/x509 in github.com/golang/go is missing certificate request signature validation. The library does not check the binding of the private key i.e., signature validation to its corresponding entities' certificate...

F5 Networks BIG-IP : OpenSSL vulnerability (K53084033)

The dsasignsetup function in crypto/dsa/dsaossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack. CVE-2016-2178 File data f5bigipSOL53084033.nasl...

Code injection

server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key...

CVE-2016-3095

server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key...

CVE-2016-3095

server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key...

CVE-2016-3095

CVE-2016-3095 affects Pulp prior to 2.8.2. The vulnerability arises in the script server/bin/pulp-gen-ca-certificate, which creates a private key in a world-readable file, allowing local users to read the CA private key. Public sources (NVD, CNVD, osv.dev, Fedora advisory) consistently state this...

CVE-2016-3095

server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key...

Design/Logic Flaw

The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data...

CVE-2016-3107

The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data...

CVE-2016-3107

The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data...

CVE-2016-3107

CVE-2016-3107 affects Pulp: the Node certificate private key is stored in a world‑readable file under /etc/pki/pulp/nodes/, enabling local users to access sensitive data. Affected versions: Pulp before 2.8.3. Root cause: insecure file permissions on the node certificate. Impact: potential disclos...

PT-2017-8337 · Pulp · Pulp

Name of the Vulnerable Software and Affected Versions: Pulp versions prior to 2.8.3 Description: The issue concerns a world-readable file containing the private key for the Node certificate, stored in the "/etc/pki/pulp/nodes/" directory. This allows local users to access sensitive data,...

Default credentials

Ceragon FibeAir IP-10 have a default SSH public key in the authorizedkeys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key...

CVE-2015-0936

Ceragon FibeAir IP-10 have a default SSH public key in the authorizedkeys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key...

CFME: default certificate used across all installs

CloudForms includes a default SSL/TLS certificate for the web server. This certificate is replaced at install time. However if an attacker were able to man-in-the-middle an administrator while installing the new certificate, the attacker could get a copy of the uploaded private key allowing for...

Western Digital TV Media Player Multiple critical vulnerabilities

Exploit for hardware platform in category web applications title: Multiple critical vulnerabilities product: Western Digital TV Media Player vulnerable version: 1.03.07 fixed version: - CVE number: - impact: Critical homepage: https://www.wdc.com found: 2017-01-17 by: Wan Ikram Office Kuala Lumpu...

Mailcow 0.14 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications + Credits: John Page a.k.a hyp3rlinx Vendor: ============= mailcow.email mailcow.github.io Product: =========== The integrated mailcow UI allows administrative work on your mail server instance as well as separated domain administrator and...

Mailcow 0.14 - Cross-Site Request Forgery

Mailcow 0.14 - Cross-Site Request Forgery + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAILCOW-v0.14-CSRF-PASSWORD-RESET-ADD-ADMIN.txt + ISR: ApparitionSec Vendor: ============= mailcow.email mailcow.github.io Produc...