SSL Root Certification Authority Certificate Information

The remote service uses an SSL certificate chain that contains a self-signed root Certification Authority certificate at the top of the chain. C Tenable Network Security, Inc. if NASLLEVEL 3208 exit0; include"compat.inc"; if description scriptid94761; scriptversion"1.2"; scriptcvsdate"Date:...

Generate Security Keys warning on Storefront management console

Question:Is the warning to generate new security keys related to the Server certificate used for storefront base URL? Answer: No, this warning is not related to the server certificate used for storefront base URL. This indicates that the Self-Signed certificates generated by storefront are expire...

IRCCloud: Exposed, outdated nginx server (v1.4.6) potentially vulnerable to heap-based buffer overflow & RCE

Summary ======== During my reconnaissance for your bug bounty program, I discovered an instance of nginx version 1.4.6 running at the IP address https://54.153.101.52. To locate it, I search for IRCCloud-related certificated and found the self-signed certificate for this server...

CVE-2016-1280

PKId in Juniper Junos OS before 12.1X44-D52, 12.1X46 before 12.1X46-D37, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D20, 13.3 before 13.3R10, 14.1 before 14.1R8, 14.1X53 before 14.1X53-D40, 14.2 before 14.2R7, 15.1 before 15.1R4, 15.1X49 before 15.1X49-D20, 15.1X53...

Design/Logic Flaw

PKId in Juniper Junos OS before 12.1X44-D52, 12.1X46 before 12.1X46-D37, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D20, 13.3 before 13.3R10, 14.1 before 14.1R8, 14.1X53 before 14.1X53-D40, 14.2 before 14.2R7, 15.1 before 15.1R4, 15.1X49 before 15.1X49-D20, 15.1X53...

CVE-2016-1280

CVE-2016-1280 affects Juniper Junos OS: remote attackers can bypass certificate validation by presenting a self-signed cert whose issuer name matches a valid Junos CA, impacting certificates used for IKE/IPsec. Affected Junos versions span many 12.x–16.1 releases (e.g., before specific revisions ...

Boozt Fashion AB: Android app does not use SSL for login

We tested the Android app, v2.0.2 To replicate: Install the app, and run it until you reach the login screen. Install PacketCapture: https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture Go to PacketCapture, go through setup, SKIP the SSL certificate install process Activate...

CVE-2016-6670

Huawei S7700, S9300, S9700, and S12700 devices with software before V200R008C00SPC500 use random numbers with insufficient entropy to generate self-signed certificates, which makes it easier for remote attackers to discover private keys by leveraging knowledge of a certificate...

CVE-2016-6670

Huawei S7700, S9300, S9700, and S12700 devices with software before V200R008C00SPC500 use random numbers with insufficient entropy to generate self-signed certificates, which makes it easier for remote attackers to discover private keys by leveraging knowledge of a certificate...

Security Advisory - A Security Vulnerability of Using Insecure Random Numbers to Generate Self-signed Certificates in Huawei Products

Some Huawei products automatically generate self-signed certificates upon the first use. The random numbers used to generate these certificates are not random enough. Different devices' certificates may use the same random number consequently, which contains the risk of an attacker compromising t...

SuperFish Vulnerability

Lenovo Security Advisory: LEN-2015-010 Potential Impact: Man-in-the-Middle Attack Severity: High Summary: This advisory only applies to Lenovo Notebook products. ThinkPad, ThinkCentre, Lenovo Desktop, ThinkStation, ThinkServer and System x products are not impacted. SuperFish was previously...

SuperFish Vulnerability - Lenovo Support US

No description provided...

Security Advisory - A Security Vulnerability of Using Insecure Random Numbers to Generate Self-signed Certificates in Huawei Products

Some Huawei products automatically generate self-signed certificates upon the first use. The random numbers used to generate these certificates are not random enough. Different devices' certificates may use the same random number consequently, which contains the risk of an attacker compromising t...

Juniper Networks Junos OS Certification Validation Vulnerability

Junos OS is prone to a certification verification vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; ...

Fedora 24 : glib-networking-2.48.1-1.fc24 (2016-5e897e9b85)

Update to 2.48.1. Add patch for denial of service when TLS server sends the same self-signed certificate twice in a chain. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

WPS Office Man-in-the-Middle Attack Vulnerability in Android Version

WPS Office is an office software suite developed independently by Kingsoft Corporation. There is a man-in-the-middle attack vulnerability in WPS Office for Android, where the software does not verify the validity of the TLS certificate when submitting a login request, which can lead to a...

Cherish.com Android APP Man-in-the-Middle Attack Vulnerability

Cherish.com is a matchmaking site. A man-in-the-middle attack vulnerability exists in the Zhenai.com Android APP, where the software does not verify the validity of the TLS certificate when logging in, resulting in a man-in-the-middle that can use self-signed certificates to carry out an attack,...

'Ridiculous' Bug in Popular Antivirus Allows Hackers to Steal all Your Passwords

If you have installed Trend Micro's Antivirus on your Windows computer, then Beware. Your computer can be remotely hijacked, or infected with any malware by even through a website – Thanks to a critical vulnerability in Trend Micro Security Software. The Popular antivirus maker and security firm...

Microsoft Revoves Trust for eDellroot Certficates

In the wake of last week’s eDellroot fiasco, Microsoft announced Monday that it revoked support for the self-signed, trusted root certificates that were found on some Dell computers. In a security advisory published on Monday, the company acknowledged that in order to prevent fraud, it removed...

Two More Self-Signed Certs, Private Keys Found on Dell Machines

eDellroot is not the only self-signed trusted root certificate on Dell computers. Researchers at Duo Security found two more on a Dell Inspiron 14-inch laptop purchased by Darren Kemp, one of its researchers who is based in Calgary, Canada, including one cert related to eDellroot that also ships...