CVE-2018-1000193

A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and canno...

CVE-2018-1000193

A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and canno...

Microsoft Windows: Digitally sign secure channel data (when possible)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: windomainsignsecurechannel.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Domain member: Digitally sign secure channel data when possible Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Windows: Digitally encrypt or sign secure channel data (always)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: windomainrequiresignseal.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Domain member: Digitally encrypt or sign secure channel data always Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH...

CVE-2015-9240

Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in...

CVE-2015-9240

CVE-2015-9240 affects the keystone node module prior to 0.3.16. The vulnerability is a partial authentication bypass in the default sign-in flow: if an attacker provides a full and correct password but only a partial email address, authentication can be granted. Affected component is the keystone...

CVE-2015-9240

Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in...

Adobe Acrobat/Reader NTLM SSO Hash Theft Vulnerability

Adobe Acrobat and Reader are the United States of America Audobee Adobe company's products. The former is a set of PDF file editing and conversion tools, the latter is a set of PDF document reading software. Adobe Acrobat/Reader NTLM SSO hash theft vulnerability. Attackers can use the vulnerabili...

Oracle Access Manager Multiple Vulnerabilities (Apr 2018 CPU)

The version of Oracle Access Manager installed on the remote host is affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid109733; scriptversion"1.8";...

Pivotal Spring Cloud SSO Connector Authentication Vulnerability

Pivotal Spring Cloud SSO Connector is a single sign-on connector for Cloud Foundry from Pivotal Software. A security vulnerability exists in Pivotal Spring Cloud SSO Connector version 2.1.2. An attacker can exploit the vulnerability to authenticate to an unbound resource server...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.2.2 security update

Red Hat Single Sign-On 7.2.2 is now available for download from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2018-9102

A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 21.84.5535.0 and earlier, and Mitel ST 14.2, versions GA27 19.49.5200.0 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for...

CVE-2018-9102

A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 21.84.5535.0 and earlier, and Mitel ST 14.2, versions GA27 19.49.5200.0 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for...

USN-3633-1 linux-euclid vulnerability

Jann Horn discovered that the Berkeley Packet Filter BPF implementation in the Linux kernel improperly performed sign extension in some situations. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code...

How Can Manufacturing Companies Improve Network Access and Security?

The manufacturing industry faces complex challenges other sectors of the economy need not worry about. Manufacturers rely heavily on everything from positive global economic trends to laws that lift certain burdens. And companies involved with manufacturing consistently focus on increased...

CVE-2018-0229

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...

Microsoft Office: Show OneDrive Sign In

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013skydrivesignin.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Show OneDrive Sign In Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

Flaw in Microsoft Outlook Lets Hackers Easily Steal Your Windows Password

A security researcher has disclosed details of an important vulnerability in Microsoft Outlook for which the company released an incomplete patch this month—almost 18 months after receiving the responsible disclosure report. The Microsoft Outlook vulnerability CVE-2018-0950 could allow attackers ...

Climbing the Ladder: Zero Trust, Single Sign-On, Multiple Applications

It is understood that there is a significant amount of complexity to securing today's enterprise, especially as more services and applications move to the cloud and a Zero Trust security model is employed. We at Akamai are actively engaged in helping enterprises adjust to a Zero Trust security...

Microsoft Outlook retrieves remote OLE content without prompting

Overview When a Rich Text RTF email is previewed in Microsoft Outlook, remotely-hosted OLE content is retrieved without requiring any additional user interaction. This can leak private information including the user's password hash, which may be cracked by an attacker. Description Microsoft Outlo...