DEBIAN-CVE-2018-18764

An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parsemqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially...

CVE-2018-14808

Emerson AMS Device Manager v12.0 to v13.5. Non-administrative users are able to change executable and library files on the affected products...

Emerson AMS Device Manager Code Execution Vulnerability

Emerson Electric AMS Device Manager is a fixed asset management software from Emerson Electric. The software provides predictive diagnostics, device configuration management, and other features. A code execution vulnerability exists in Emerson Electric AMS Device Manager versions 12.0 through 13....

Debian DLA-1518-1 : polarssl security update

Two vulnerabilities were discovered in polarssl, a lightweight crypto and SSL/TLS library nowadays continued under the name mbedtls which could result in plain text recovery via side-channel attacks. Two other minor vulnerabilities were discovered in polarssl which could result in arithmetic...

Debian: Security Advisory (DLA-1518-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2018:2842-1 Security update for gnutls

This update for gnutls fixes the following issues: Security issues fixed: - Improved mitigations against Lucky 13 class of attacks - 'Just in Time' PRIME + PROBE cache-based side channel attack can lead to plaintext recovery CVE-2018-10846, bsc1105460 - HMAC-SHA-384 vulnerable to Lucky thirteen...

SUSE-SU-2018:2825-1 Security update for gnutls

This update for gnutls fixes the following issues: This update for gnutls fixes the following issues: Security issues fixed: - Improved mitigations against Lucky 13 class of attacks - 'Just in Time' PRIME + PROBE cache-based side channel attack can lead to plaintext recovery CVE-2018-10846,...

CVE-2018-15546

Accusoft PrizmDoc version 13.3 and earlier contains a Stored Cross-Site Scripting issue through a crafted PDF file...

Red Hat Openstack Insecure Retrieval Vulnerability

Red Hat OpenStack is an open source IaaS Infrastructure as a Service solution from Red Hat. The solution supports the creation and management of private, public, and hybrid clouds. openstack-rabbitmq-container and openstack-containers are among the container components. A security vulnerability...

Ice Qube Thermal Management Center Authentication Bypass Vulnerability

Ice Qube Thermal Management Center is a thermal management application from Ice Qube USA. The program includes features such as email notifications, remote management, LCD display and temperature alarms. An authentication bypass vulnerability exists in Ice Qube Thermal Management Center versions...

Ice Qube Thermal Management Center Information Disclosure Vulnerability

Ice Qube Thermal Management Center is a thermal management application from Ice Qube USA. The program includes features such as email notifications, remote management, LCD display and temperature alarms. An information disclosure vulnerability exists in Ice Qube Thermal Management Center versions...

CVE-2017-14026

In Ice Qube Thermal Management Center versions prior to version 4.13, the web application does not properly authenticate users which may allow an attacker to gain access to sensitive information...

CVE-2018-16550

TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by skipping the "Cancel" step, which makes it easier to determine the correct value of the default 4-digit PIN...

Timing Attack

libgnutls.c is vulnerable to timing attacks. The uses the wrong constant during HMAC-SHA-384 hashing, allowing a malicious user to conduct gain access to sensitive information by analyzing the timing data by sending crafted packets. This is similar to the "Lucky Thirteen" attack...

Code injection

It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets...

CVE-2018-10844

It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets...

Code injection

It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets...

CVE-2018-10845

It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets...

DEBIAN-CVE-2018-10846

A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets...

DEBIAN-CVE-2018-10845

It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets...