CVE-2016-1321

Cisco Universal Small Cell devices running firmware R2.12–R3.5 contain an image-decryption key in flash memory, enabling remote attackers to bypass a certificate-validation check and retrieve sensitive firmware images and device IP addresses by contacting a Cisco server. Root cause: exposed decry...

PT-2016-4708

Name of the Vulnerable Software and Affected Versions Cisco Universal Small Cell devices versions R2.12 through R3.5 Description The issue allows remote attackers to bypass a certain certificate-validation feature and obtain sensitive firmware-image and IP address data via a request to an...

CVE-2016-1321: Exposure of Sensitive Information to an Unauthorized Actor

Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, which allows remote attackers to bypass a certain certificate-validation feature and obtain sensitive firmware-image and IP address data via a request to an unspecified Cisco serve...

Cisco Universal Small Cell Devices Unauthorized Firmware Retrieval Vulnerability

A vulnerability in Cisco Universal Small Cell devices could allow an unauthenticated, remote attacker to retrieve firmware from a Cisco-hosted binary server. The vulnerability is due to insufficient enforcement of the two-way certificate validation process by the Cisco-hosted binary server to...

Cisco Small Business 500 Device Web GUI Denial of Service Vulnerability

The Cisco Small Business 500 Device is a 500 series stackable managed switch product from Cisco. A security vulnerability in the Web GUI of the Cisco Small Business 500 Device allows a remote attacker to perform a denial of service by sending a specially crafted HTTP request...

OpenSSL 'Diffie-Hellman small subgroups' MitM Attack Vulnerability - Windows

OpenSSL is prone to a man-in-the-middle MitM attack vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-1303

The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a crafted HTTP request, aka Bug ID CSCul65330...

CVE-2016-1303

The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a crafted HTTP request, aka Bug ID CSCul65330...

Design/Logic Flaw

The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a crafted HTTP request, aka Bug ID CSCul65330...

CVE-2016-1303

The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a crafted HTTP request, aka Bug ID CSCul65330...

CVE-2016-1303

The CVE-2016-1303 entry concerns the Cisco Small Business 500 Series devices, where the web GUI on version 1.2.0.92 can be remotely abused to cause a denial of service by sending a crafted HTTP request (Bug ID CSCul65330). Affected products are Cisco Small Business 500 devices with a web-based GU...

Cisco Small Business SG300 Denial of Service Vulnerability

Cisco Small Business SG300 is the SG300 series of smart switch products from Cisco. A security vulnerability in the web-management GUI implementation of the Cisco Small Business SG300 allows remote attackers to conduct denial-of-service attacks by sending specially crafted HTTPS requests...

PT-2016-4695

Name of the Vulnerable Software and Affected Versions Cisco Small Business 500 devices version 1.2.0.92 Description The web GUI on Cisco Small Business 500 devices allows remote attackers to cause a denial of service via a crafted HTTP request. Recommendations For version 1.2.0.92, update to a...

CVE-2016-1303: Improper Input Validation

The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a crafted HTTP request, aka Bug ID CSCul65330...

OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)

Usual Mandatory Disclaimer: IANAC I am not a cryptographer so I might likely end up writing a bunch of mistakes in this blog post... tl;dr The OpenSSL 1.0.2 releases suffer from a Key Recovery Attack on DH small subgroups. This issue got assigned CVE-2016-0701 with a severity of High and OpenSSL...

Cisco Small Business 500 Series Switches Denial of Service Vulnerability

A vulnerability in the web-based GUI of the Cisco Small Business 500 Series Stackable Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient handling of HTTP requests. An attacker...

Internet Bug Bounty: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)

Full write up: http://intothesymmetry.blogspot.ch/2016/01/openssl-key-recovery-attack-on-dh-small.html DH small subgroups CVE-2016-0701 ================================== Severity: High Historically OpenSSL usually only ever generated DH parameters based on "safe" primes. More recently in version...

CVE-2016-1299

The web-management GUI implementation on Cisco Small Business SG300 devices 1.4.1.x allows remote attackers to cause a denial of service HTTPS outage via crafted HTTPS requests, aka Bug ID CSCuw87174...

Cisco Small Business SG300 Managed Switch Web Framework GUI Function Denial of Service Vulnerability

A vulnerability in the GUI function in the web framework code of Cisco Small Business SG300 Managed Switches could allow an unauthenticated, remote attacker to cause the HTTPS process to become unresponsive, resulting in a partial denial of service DoS condition. The vulnerability is due to...

CVE-2016-1299: Undefined Security Weakness

The web-management GUI implementation on Cisco Small Business SG300 devices 1.4.1.x allows remote attackers to cause a denial of service HTTPS outage via crafted HTTPS requests, aka Bug ID CSCuw87174...