SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based...

CVE-2016-0248

IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions via unspecified vectors...

Cisco Firepower Management Center and FireSIGHT System Software Security Bypass Vulnerability (CNVD-2016-08193)

Cisco Firepower Management Center and FireSIGHT System Software are management center software from Cisco USA. A security vulnerability exists in Cisco Firepower Management Center and Cisco FireSIGHT System that allows an attacker to bypass configured SSL inspection rules with a specially crafted...

CVE-2016-6399

Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service device reload via crafted 1 SSL or 2 TLS packets, aka Bug ID CSCvb16317...

CVE-2016-6899

The Intelligent Baseboard Management Controller iBMC in Huawei RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, RH2288H V3 servers with software before V100R003C00SPC515, RH5885 V3 servers with software before V100R003C10SPC102, a...

UnrealIRCd SSL Certificate Spoofing Vulnerability

UnrealIRCd is an IRC service program. A security vulnerability exists in UnrealIRCd SSL certificates that allows an attacker to spoof valid certificates...

Inspircd SSL Certificate Spoofing Vulnerability

InspIRCd is an extensible and modular Internet Relay Chat IRC server written in C++ for Linux, BSD, Windows and Mac OS X systems. Inspircd suffers from a security vulnerability. An attacker can exploit this vulnerability to spoof valid certificates...

SSL/TLS Protocol Information Disclosure Vulnerability in Multiple Red Hat Products

Red Hat Enterprise Linux and others are products of the United States Red Hat.Red Hat Enterprise Linux RHEL is a suite of Linux operating systems for enterprise users maintained and distributed by Red Hat, Inc.Red Hat JBoss Web Server is a Web server built on top of Apache and Tomcat.SSL/TLS is t...

IBM Security Privileged Identity Manager Authentication Vulnerability

IBM Security Privileged Identity Manager is an identity management product within IBM Identity Governance and Management, an identity governance solution from IBM USA, that protects, automates, and audits the use of privileged identities to help defend against insider threats and improve security...

The vulnerability of the OpenSSL software allows a malicious attacker to compromise the confidentiality of protected information.

The vulnerability exists in OpenSSL due to the incorrect use of the “no-ssl3” option. Exploiting this vulnerability allows malicious actors to circumvent access restrictions by using SSL 3.0 negotiation. This vulnerability is related to the s23clnt.c and s23srvr.c files...

The vulnerability of the Cisco Unified Communications Manager software allows a malicious actor to execute arbitrary code.

The vulnerability exists in the function dtls1reassemblefragment in d1both.c in OpenSSL, due to an improper check of the length of fragments in DTLS ClientHello messages. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure buffer overflow an...

The vulnerability of Trillian software allows a malicious attacker to compromise the confidentiality and integrity of protected information.

The vulnerability exists in Cerulean Studios Trillian due to the lack of verification of SSL certificates during MSN authentication. Exploiting this vulnerability allows malicious actors operating remotely to obtain MSN credentials by using a “man-in-the-middle” attack and replacing the SSL...

The vulnerability of the Internet Explorer browser allows a malicious attacker to compromise the confidentiality and integrity of protected information.

A vulnerability that allows bypassing security mechanisms exists in Internet Explorer and is related to the improper implementation of requirements for high-security SSL certificates, particularly regarding the prohibition on using group certificates. Exploiting this vulnerability enables a...

The vulnerability of the OpenSSL software allows a malicious attacker to compromise the confidentiality of protected information.

The vulnerability exists in the SSL protocol for OpenSSL due to the use of non-deterministic padding for CBC encryption block chaining of the encryption text. Exploiting this vulnerability allows a malicious actor to obtain unencrypted data by using a padding prediction attack, known as POODLE...

Sushiro App fails to verify SSL server certificates

Overview Sushiro App provided by AKINDO SUSHIRO CO., LTD. fails to verify SSL server certificates. Yuta Teshima of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...

The vulnerability of the Mac OS X operating system, which allows a perpetrator to obtain confidential information

The vulnerability of the Tcl component in the Mac OS X operating system is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to obtain confidential information by using SSLv2 support...

Denial of Service Vulnerability in Multiple F5 BIG-IP Products (CNVD-2016-03941)

F5 BIG-IP Analytics and others are products of F5 Corporation in the U.S. F5 BIG-IP Analytics is a suite of Web application performance analytics software. the APM is a suite of solutions that provide secure and unified access to business-critical applications and networks. and the LTM is a local...

Man-in-the-middle attack vulnerabilities in multiple DMM products

DMM FX Trade for Android and others are Android-based applications developed by DMM Securities Inc. of Japan for foreign exchange trade transactions. A security vulnerability exists in several DMM products, which stems from the program's failure to validate SSL server certificates. An attacker...

CVE-2016-1853

Tcl in Apple OS X before 10.11.5 allows remote attackers to obtain sensitive information by leveraging SSLv2 support...

THE HYAKUGO BANK 105 BANK Man-in-the-Middle Attack Vulnerability

THE HYAKUGO BANK 105 BANK is a suite of online banking mobile apps from THE HYAKUGO BANK, Japan. A man-in-the-middle attack vulnerability exists in THE HYAKUGO BANK 105 BANK, which arises from the program failing to properly validate an SSL server certificate. An attacker could use this...