91902 matches found
U.S. Dept Of Defense: Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://████
Description Hello. Some time ago, researcher Orange Tsai from DEVCORE team had a talk on Defcon/BlackHat regarding Pulse Secure SSL VPN vulnerabilities fixed on 2019/4/25: CVE-2019-11510 - Pre-auth Arbitrary File Reading CVE-2019-11542 - Post-auth Stack Buffer Overflow CVE-2019-11539 - Post-auth...
Five years later, Heartbleed vulnerability still unpatched
The Heartbleed vulnerability was introduced into the OpenSSL crypto library in 2012. It was discovered and fixed in 2014, yet today—five years later—there are still unpatched systems. This article will provide IT teams with the necessary information to decide whether or not to apply the Heartblee...
CVE-2019-1231
An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information Disclosure Vulnerability'...
CVE-2019-1231
An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information Disclosure Vulnerability'...
Information disclosure
An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information Disclosure Vulnerability'...
CVE-2019-1231
An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information Disclosure Vulnerability'...
CVE-2019-1231
CVE-2019-1231 corresponds to a Rome SDK information-disclosure vulnerability where server SSL/TLS certificate validation is mishandled. The Red Hat/NVD/MSRC entries describe an unauthenticated attacker who can perform a Man-in-the-Middle to exploit the issue by intercepting an established connect...
PT-2019-5517 · Openwrt · Openwrt
Name of the Vulnerable Software and Affected Versions: OpenWrt versions 15.05.1 through 18.06.4 Description: The issue is related to errors in the certificate authentication procedure of the Ustream-SSL library in OpenWrt. This can be exploited by a remote attacker to perform a man-in-the-middle...
NewStart CGSL CORE 5.05 / MAIN 5.05 : 389-ds-base Vulnerability (NS-SA-2019-0170)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has 389-ds-base packages installed that are affected by a vulnerability: - In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout'...
DEBIAN-CVE-2019-1563
In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted...
Rome SDK Information Disclosure Vulnerability
An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation. This vulnerability allows an unauthenticated attacker to establish connection with an invalid SSL/TLS server certificate. To exploit this, an attacker would have to Man-In-The-Middle ...
Security Bulletin: Security Vulnerabilties exist in IBM Cognos Controller
Summary Security Vulnerabilities exist in IBM Cognos Controller. When performing security testing, you might encounter a "Missing Secure Attribute in Encrypted Session SSL Cookie" error message. IBM Cognos Controller versions 10.4.1, 10.4.0, 10.3.1 and 10.3.0, by default, do not have this setting...
CVE-2019-16179
Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration...
CVE-2019-16179
Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration...
Default configuration
Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration...
CVE-2019-16179
CVE-2019-16179 affects LimeSurvey prior to version 3.17.14, where the default configuration does not enforce SSL/TLS usage. The vulnerability arises from the software not requiring HTTPS by default, potentially allowing insecure communications. Public sources in the connected documents confirm th...
Exploit for Path Traversal in Ivanti Connect_Secure
pwn-pulse.sh Exploit for Pulse Connect Secure SSL VPN arbitr...
Cisco Content Security Virtual Appliance M380 IronPort Remote Cross Site Host Modification
// // // Disclaimer: // This or previous programs are for Educational purpose ONLY. Do not use it without permission. // The usual disclaimer applies, especially the fact that Todor Donev is not liable for any damages // caused by direct or indirect use of the information or functionality provide...