INSIDE Secure MatrixSSL Denial of Service Vulnerability (CNVD-2016-09588)

INSIDE Secure MatrixSSL is an embedded, open source SSLv3 stack from INSIDE Secure, France, designed for small applications and devices. A denial of service vulnerability exists in MatrixSSL, which can be exploited by an attacker to cause a denial of service...

INSIDE Secure MatrixSSL Buffer Overflow Vulnerability

INSIDE Secure MatrixSSL is an embedded, open source SSLv3 stack from INSIDE Secure, France, designed for small applications and devices. A buffer overflow vulnerability exists in several versions of MatrixSSL, which can be exploited by an attacker to execute arbitrary code...

tomcat: Session fixation

A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests...

CVE-2016-6550

The U by BB&T app 1.5.4 and earlier for iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based...

CVE-2016-0248

IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions via unspecified vectors...

Cisco Firepower Management Center and FireSIGHT System Software Security Bypass Vulnerability (CNVD-2016-08193)

Cisco Firepower Management Center and FireSIGHT System Software are management center software from Cisco USA. A security vulnerability exists in Cisco Firepower Management Center and Cisco FireSIGHT System that allows an attacker to bypass configured SSL inspection rules with a specially crafted...

CVE-2016-6399

Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service device reload via crafted 1 SSL or 2 TLS packets, aka Bug ID CSCvb16317...

CVE-2016-6899

The Intelligent Baseboard Management Controller iBMC in Huawei RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, RH2288H V3 servers with software before V100R003C00SPC515, RH5885 V3 servers with software before V100R003C10SPC102, a...

UnrealIRCd SSL Certificate Spoofing Vulnerability

UnrealIRCd is an IRC service program. A security vulnerability exists in UnrealIRCd SSL certificates that allows an attacker to spoof valid certificates...

Inspircd SSL Certificate Spoofing Vulnerability

InspIRCd is an extensible and modular Internet Relay Chat IRC server written in C++ for Linux, BSD, Windows and Mac OS X systems. Inspircd suffers from a security vulnerability. An attacker can exploit this vulnerability to spoof valid certificates...

SSL/TLS Protocol Information Disclosure Vulnerability in Multiple Red Hat Products

Red Hat Enterprise Linux and others are products of the United States Red Hat.Red Hat Enterprise Linux RHEL is a suite of Linux operating systems for enterprise users maintained and distributed by Red Hat, Inc.Red Hat JBoss Web Server is a Web server built on top of Apache and Tomcat.SSL/TLS is t...

IBM Security Privileged Identity Manager Authentication Vulnerability

IBM Security Privileged Identity Manager is an identity management product within IBM Identity Governance and Management, an identity governance solution from IBM USA, that protects, automates, and audits the use of privileged identities to help defend against insider threats and improve security...

The vulnerability of the Cisco Unified Communications Manager software allows a malicious actor to execute arbitrary code.

The vulnerability exists in the function dtls1reassemblefragment in d1both.c in OpenSSL, due to an improper check of the length of fragments in DTLS ClientHello messages. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure buffer overflow an...

The vulnerability of the Internet Explorer browser allows a malicious attacker to compromise the confidentiality and integrity of protected information.

A vulnerability that allows bypassing security mechanisms exists in Internet Explorer and is related to the improper implementation of requirements for high-security SSL certificates, particularly regarding the prohibition on using group certificates. Exploiting this vulnerability enables a...

The vulnerability of the OpenSSL software allows a malicious attacker to compromise the confidentiality of protected information.

The vulnerability exists in the SSL protocol for OpenSSL due to the use of non-deterministic padding for CBC encryption block chaining of the encryption text. Exploiting this vulnerability allows a malicious actor to obtain unencrypted data by using a padding prediction attack, known as POODLE...

The vulnerability of the OpenSSL software allows a malicious attacker to compromise the confidentiality of protected information.

The vulnerability exists in OpenSSL due to the incorrect use of the “no-ssl3” option. Exploiting this vulnerability allows malicious actors to circumvent access restrictions by using SSL 3.0 negotiation. This vulnerability is related to the s23clnt.c and s23srvr.c files...

The vulnerability of Trillian software allows a malicious attacker to compromise the confidentiality and integrity of protected information.

The vulnerability exists in Cerulean Studios Trillian due to the lack of verification of SSL certificates during MSN authentication. Exploiting this vulnerability allows malicious actors operating remotely to obtain MSN credentials by using a “man-in-the-middle” attack and replacing the SSL...

Sushiro App fails to verify SSL server certificates

Overview Sushiro App provided by AKINDO SUSHIRO CO., LTD. fails to verify SSL server certificates. Yuta Teshima of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...

The vulnerability of the Mac OS X operating system, which allows a perpetrator to obtain confidential information

The vulnerability of the Tcl component in the Mac OS X operating system is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to obtain confidential information by using SSLv2 support...