Authentication flaw

RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list ACL permissions on a Windows Named Pipe were not sufficient to prevent access by unauthorized users. The attacker with local access to the system can exploit this vulnerability to...

CVE-2018-1234

CVE-2018-1234 affects RSA Authentication Agent for Web for IIS versions 8.0.1 and earlier. The root cause is insufficient ACL protections on a Windows Named Pipe, allowing a local attacker to read configuration properties of the authentication agent. Exploitation requires local access; no remote ...

CVE-2018-1233

RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnerability. The attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context ...

CVE-2018-1234

RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list ACL permissions on a Windows Named Pipe were not sufficient to prevent access by unauthorized users. The attacker with local access to the system can exploit this vulnerability to...

CVE-2018-1232

CVE-2018-1232 affects RSA Authentication Agent for Web (IIS and Apache) up to version 8.0.1, vulnerable to a stack-based buffer overflow when processing certain malformed web cookies. This can crash the authentication agent, causing a denial of service. Other sources reiterate similar vulnerabili...

CVE-2018-1233

RSA Authentication Agent for Web for IIS and for Apache Web Server (versions 8.0.1 and earlier) are affected by a cross-site scripting (CVE-2018-1233) vulnerability that could allow an attacker to execute arbitrary HTML/JavaScript in a user’s browser session. Public details in multiple sources de...

CVE-2018-1232

RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur when handling certain malicious web cookies that have invalid formats. The attacker could exploit this vulnerability to crash the...

RSA Authentication Agent For Web XSS / Buffer Overflow Vulnerability

RSA Authentication Agent for Web for both IIS and Apache Web Server version 8.0. 1 and earlier contain multiple vulnerabilities that could potentially be exploit ed by malicious users to compromise affected systems. These issues include cross site scripting, buffer overflow, and information...

Unspecified Vulnerability in IBM Rational Collaborative Lifecycle Management RSA DM

IBM Rational Collaborative Lifecycle Management CLM is a suite of collaborative lifecycle management solutions from IBM in the United States. The solution combines three products, RTC, RQM, and RRC, in an IBM SmartCloud Enterprise cloud environment image to provide requirements management, change...

Code injection

IBM RSA DM IBM Rational Collaborative Lifecycle Management 5.0 and 6.0 could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force ID: 132625...

CVE-2017-1602

IBM RSA DM IBM Rational Collaborative Lifecycle Management 5.0 and 6.0 could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force ID: 132625...

CVE-2017-1602

IBM RSA DM IBM Rational Collaborative Lifecycle Management 5.0 and 6.0 could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force ID: 132625...

CVE-2017-1602

Summary of CVE-2017-1602 (IBM RSA DM/CLM) : IBM Rational Collaborative Lifecycle Management (CLM) 5.0–6.0.5 is affected by an unauthenticated exposure vulnerability in RSA DM where an authenticated user can access settings they should not be able to via a specially crafted URL. The NVD entry assi...

Cisco node-jos Resign Tokens Proof Of Concept

import base64 import urllib import rsa import sys zi0Black ''' POC of CVE-2018-0114 Cisco node-jose 0.11.0 Created by Andrea Cappa aka @zi0Black GitHub,Twitter,Telegram Mail: [email protected] Site: https://zioblack.xyz A special thanks to Louis Nyffenegger, the founder of PentesterLab, for al...

mbed TLS (PolarSSL) -- multiple vulnerabilities

Simon Butcher reports: Defend against Bellcore glitch attacks by verifying the results of RSA private key operations. Fix implementation of the truncated HMAC extension. The previous implementation allowed an offline 2^80 brute force attack on the HMAC key of a single, uninterrupted connection wi...

CVE-2015-7449

IBM Rational Collaborative Lifecycle Management CLM 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Quality Manager RQM 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational...

CVE-2015-7449

CVE-2015-7449 affects IBM Jazz Foundation-based products (CLM, RRC, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM, and related Jazz Team Server components). The root cause is the use of weaker than expected encryption, enabling local users to obtain sensitive information. Affected versions include CL...

Cisco node-jos 0.11.0 - Re-sign Tokens

Cisco node-jos 0.11.0 - Re-sign Tokens !/usr/bin/env python3 import base64 from urllib.parse import quoteplus import rsa import sys zi0Black ''' EDB Note: This has been updated https://github.com/offensive-security/exploitdb/pull/139 POC of CVE-2018-0114 Cisco node-jose = 8 return b::-1 def...

Security Bulletin: NVIDIA Jetson TX1, Jetson TK1, Jetson TX2, and Tegra K1 L4T Security Updates for Multiple Vulnerabilities

Jetson and Tegra L4T contain vulnerabilities which may lead to denial of service, escalation of privileges, or information disclosure. Go to NVIDIA Product Security. Vulnerability Details The following sections summarize the potential vulnerabilities. Descriptions use CWE™ and risk assessments...

Cisco node-jos < 0.11.0 - Re-sign Tokens Exploit

Exploit for multiple platform in category web applications import base64 import urllib import rsa import sys zi0Black ''' POC of CVE-2018-0114 Cisco node-jose 0.11.0 Created by Andrea Cappa aka @zi0Black GitHub,Twitter,Telegram Mail: email protected Site: https://zioblack.xyz A special thanks to...