Ruby http gem man-in-the-middle attack vulnerability

The Ruby http gem is a standard package for managing Ruby libraries and programs. A man-in-the-middle attack vulnerability exists in Ruby http gem versions prior to 0.7.3, which stems from the program failing to validate the hostname during an SSL connection. A remote attacker could use this...

The vulnerability of the SSL software used in Backup Exec’s backup and recovery services allows attackers to execute arbitrary code or trigger a service failure.

The vulnerability of Backup Exec’s SSL software for backup and restoration services relates to the use of memory after it is freed i.e., after the agent completes its tasks. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or cause service failures using...

Cisco Firepower Threat Defense Software Denial of Service Vulnerability

Cisco Appliance ASA 5500-X Series Next-Generation Firewalls, etc. are firewall products from Cisco, U.S.A. Firepower Threat Defense FTD Software is one of the intrusion prevention systems. A denial of service vulnerability exists in the SSL traffic encryption process of FTD Software in multiple...

DEBIAN-CVE-2015-1828

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack...

CVE-2017-12245

A vulnerability in SSL traffic decryption for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause depletion of system memory, aka a Firepower Detection Engine SSL Decryption Memory Consumption Denial of Service vulnerability. If this memory leak...

mysql: incorrect enforcement of ssl-mode=REQUIRED in MySQL 5.5 and 5.6

It was discovered that the MySQL client command line tools only checked after authentication whether server supported SSL. A man-in-the-middle attacker could use this flaw to hijack client's authentication to the server even if the client was configured to require SSL connection...

DEBIAN-CVE-2015-3420

The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service login process crash via vectors related to handshake failures...

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based...

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based...

BSA-2017-362

Security Advisory ID : BSA-2017-362 Component : Apache Revision : 1.0: Interim In Apachehttpd2.2.x before 2.2.33 and 2.4.x before 2.4.26,modsslmay dereference a NULL pointer when third-party modules callaphookprocessconnection during an HTTP request to an HTTPS port. Affected Products Brocade is...

SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS

A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients...

DEBIAN-CVE-2015-7944

The RESTful control interface aka RAPI or ganeti-rapi in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service resourc...

The vulnerability of the web interface of Cisco Adaptive Security Appliance’s microprogramming software allows a hacker to obtain user credentials.

The vulnerability of the web interface of Cisco Adaptive Security Appliance microprogramming software is related to the lack of protection for service data during interactions with the SSL Connection Profile using the LDAP protocol. Exploiting this vulnerability can allow a malicious actor to...

4car.standvirtual.com XSS vulnerability

Vulnerable URL: https://4car.standvirtual.com/?q=%27%22%3E%3Csvg%2Fonload%3Dconfirm%28%2FOPENBUGBOUNTY%2F%29%3E%5Bcategoryid%5D=%5Border%5D=createdat%3Adesc Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown...

Cisco Firepower System Software SSL Policy Bypass Vulnerability

Cisco Firepower is a family of advanced firewalls. A security vulnerability exists in Cisco Firepower's handling of specially constructed SSL packet headers that interact with multiple configurations of SSL policies, allowing remote attackers to exploit the vulnerability to submit special SSL...

CVE-2017-6766

A vulnerability in the Secure Sockets Layer SSL Decryption and Inspection feature of Cisco Firepower System Software 5.4.0, 5.4.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1, and 6.2.2 could allow an unauthenticated, remote attacker to bypass the SSL policy for decrypting and inspecting traffic on an affected...

CVE-2017-6752

A vulnerability in the web interface of the Cisco Adaptive Security Appliance ASA 9.33 and 9.62 could allow an unauthenticated, remote attacker to determine valid usernames. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to the...

Cisco Adaptive Security Appliance Information Disclosure Vulnerability (CNVD-2017-20382)

The Cisco Adaptive Security Appliance is a set of firewall appliances from the American company Cisco. A security vulnerability exists in the Cisco Adaptive Security Appliance when configured with both Lightweight Directory Access Protocol LDAP and SSL Connection Profile, which allows remote...

PT-2017-2627 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance versions 9.33 through 9.62 Description: The issue is related to a lack of protection for service data when interacting with the SSL Connection Profile via the LDAP protocol in the web interface of the Cisco...

OSRAM SYLVANIA Osram Lightify Home Man-in-the-Middle Attack Vulnerability

OSRAM SYLVANIA Osram Lightify Home is a set of open IoT platforms for automated control of lighting devices from OSRAM Germany. OSRAM SYLVANIA Osram Lightify Home A security vulnerability exists in versions 2016-07-26 and earlier, which stems from the program's failure to use SSL pinning.An...