1224 matches found
CVE-2017-11131
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for...
Authentication flaw
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for...
CVE-2017-11131
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for...
CVE-2017-11131
The CVE-2017-11131 issue affects heinekingmedia StashCat across Android (1.7.5), Web (0.0.80w), and Desktop (0.0.86). The root cause is hashing user passwords with SHA-512 without a salt or key-derivation function, and using only the first 32 bytes of the hash. This enables dictionary and rainbow...
CVE-2017-11131
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for...
Google Chrome Bans Chinese SSL Certificate Authorities WoSign and StartCom
As a punishment announced last October, Google will no longer trust SSL/TLS certificate authorities WoSign and its subsidiary StartCom with the launch of Chrome 61 for not maintaining the "high standards expected of CAs." The move came after Google was notified by GitHub's security team on August...
Weak Hash Algorithm
contwidgetor is using SHA-1 which is a weak hash algorithm. The use of the weak algorithm in the authentication allows attackers to easily perform collsion attacks...
March 2017 Preview of Monthly Quality Rollup for Windows 8.1 and Windows Server 2012 R2
March 2017 Preview of Monthly Quality Rollup for Windows 8.1 and Windows Server 2012 R2 The March 2017 Preview of Monthly Quality Rollup includes some new improvements and fixes for the Windows 8.1 and Windows Server 2012 R2 platforms. We recommend that you apply this quality rollup as part of yo...
CVE-2016-8741
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for...
Authentication flaw
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for...
CVE-2016-8741
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for...
Patch Tuesday - May 2017
It's a relatively light month as far as Patch Tuesdays go, with Microsoft issuing fixes for a total of seven vulnerabilities as part of their standard update program. However, an eighth, highly critical vulnerability CVE-2017-0290 that had some of the security community buzzing over the weekend w...
Microsoft Makes it Official, Cuts off SHA-1 Support in IE, Edge
Lost in yesterday’s shuffle of emergency updates and regularly scheduled monthly patches was Microsoft’s announcement that it was officially cutting off SHA-1 support in Internet Explorer 11 and Edge. Going forward, both browsers will block webpages signed with a SHA-1 TLS or SSL certificate from...
Microsoft Windows Monthly Rollup (KB4019215)
This host is missing a critical security update monthly rollup according to microsoft KB4019215. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...
Microsoft Fixes Malware Protection Engine and Several 0-Day Vulnerabilities, and Deprecates SHA-1
Hours before today’s Patch Tuesday release on the eve of May 8, Microsoft released an emergency updated to fix a vulnerability in their Malware Protection Engine. This critical vulnerability allows an attacker to take complete control of the victim's machine by just sending an e-mail attachment...
May 9, 2017—KB4019213 (Security-only update)
None None...
May 9, 2017—KB4019264 (Monthly Rollup)
None None...
Web Exploit Detector - Tool To Detect Possible Infections, Malicious Code And Suspicious Files In Web Hosting Environments
The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites. Running the application will generate a list of...
Node.js Security Scanner: Web Exploit Detector
Node.js Security Scanner: Web Exploit Detector The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites...