[SECURITY] [DLA 425-1] libssh security update

Package : libssh Version : 0.4.5-3+squeeze3 CVE ID : CVE-2016-0739 Aris Adamantiadis of the libssh team discovered that libssh, an SSH2 protocol implementation used by many applications, did not generate sufficiently long Diffie-Hellman secrets. This vulnerability could be...

libssh: man-in-the-middle

libssh versions 0.1 and above have a bits/bytes confusion bug and generate the an anormaly short ephemeral secret for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. The resulting secret is 128 bits long, instead of the recommended sizes of 1024 and 2048 bits...

DLA-425-1 libssh - security update

Bulletin has no description...

Cisco Application Policy Infrastructure Controller Enterprise Module Cross-Site Scripting Vulnerability

Cisco Application Policy Infrastructure Controller Enterprise is an application policy infrastructure control module. A cross-site scripting vulnerability exists in Cisco Application Policy Infrastructure Controller Enterprise, which allows remote attackers to exploit the vulnerability to inject...

UBUNTU-CVE-2015-5335

Cross-site request forgery CSRF vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub U...

IBM QRadar SIEM Information Disclosure Vulnerability (CNVD-2016-01145)

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. A security...

Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers

Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers Inductive Automation Ignition 7.8.1 Remote Leakage Of Shared Buffers Vendor: Inductive Automation Product web page: http://www.inductiveautomation.com Affected version: 7.8.1 b2016012216 and 7.8.0 b2015101414 Platform: Java...

Inductive Automation Ignition 7.8.1 Remote Leakage Of Shared Buffers

Inductive Automation Ignition 7.8.1 Remote Leakage Of Shared Buffers Vendor: Inductive Automation Product web page: http://www.inductiveautomation.com Affected version: 7.8.1 b2016012216 and 7.8.0 b2015101414 Platform: Java Summary: Ignition is a powerful industrial application platform with full...

Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers

Inductive Automation Ignition 7.8.1 Remote Leakage Of Shared Buffers Vendor: Inductive Automation Product web page: http://www.inductiveautomation.com Affected version: 7.8.1 b2016012216 and 7.8.0 b2015101414 Platform: Java Summary: Ignition is a powerful industrial application platform with full...

Inductive Automation Ignition 7.8.1 Remote Leakage Of Shared Buffers

Summary Ignition is a powerful industrial application platform with fully integrated development tools for building SCADA, MES, and IIoT solutions. Description Remote unauthenticated atackers are able to read arbitrary data from other HTTP sessions because Ignition uses a vulnerable Jetty server...

CVE-2015-5050

Cross-site request forgery CSRF vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to hijack the authentication of...

Cisco Application Policy Infrastructure Controller Cross-Site Scripting Vulnerability

The Cisco Application Policy Infrastructure Controller APIC is the U.S. A controller that automates the management of application-centric infrastructure ACI. A cross-site scripting vulnerability exists in the Cisco Application Policy Infrastructure Controller, which can be exploited by remote...

Cisco Fog Director Cross-Site Scripting Vulnerability

Cisco Fog Director is an automated management platform for centralized management of multiple applications running at the network edge. The platform enables control of application settings and lifecycles, and supports access to and monitoring of large-scale IoT deployments. A cross-site scripting...

Cisco Unity Connection Cross-Site Scripting Vulnerability (CNVD-2016-00787)

Cisco Unity Connection is a voice messaging platform. A cross-site scripting vulnerability exists in Cisco Unity Connection, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user session...

Cisco Application Policy Infrastructure Controller Enterprise Module Cross-Site Scripting Vulnerability

Cisco Application Policy Infrastructure Controller Enterprise Module is a suite of Cisco applications that provide a policy-based approach to automating the configuration of end-to-end infrastructure controllers. A cross-site scripting vulnerability in Cisco Application Policy Infrastructure...

Hardcoded credentials

The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, which makes it easier for remote attackers to obtain access via a 1 SSH or 2 HTTP session, a different vulnerability than CVE-2016-1984...

The vulnerability of the Mac OS X operating system, which allows a hacker to increase their privileges

The vulnerability of the Mac OS X operating system is caused by authentication errors during new sessions. Exploiting this vulnerability can allow an attacker, operating locally, to increase their privileges...

WordPress Cross-Site Scripting Vulnerability (CNVD-2016-00258)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Software Foundation. WordPress suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain...

Atlassian Confluence Cross-Site Scripting Vulnerability

Atlassian Confluence is a professional enterprise knowledge management and collaboration software that can also be used to build enterprise WiKi. Atlassian Confluence suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious...

IBM Connections Cross-Site Scripting Vulnerability (CNVD-2016-00162)

IBM Connections is a suite of social software platforms. The platform provides advanced analytics and real-time data monitoring capabilities and accelerates web collaboration within and outside the organization through IBM SmartCloud services. IBM Connections suffers from a cross-site scripting...