4146 matches found
Fixed in Apache Tomcat 9.0.0.M10
Low: Unrestricted Access to Global Resources CVE-2016-6797 The ResourceLinkFactory did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether...
Fixed in Apache Tomcat 8.5.5 and 8.0.37
Low: Unrestricted Access to Global Resources CVE-2016-6797 The ResourceLinkFactory did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether...
CVE-2016-5429
jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php...
CVE-2016-5429
jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php...
Information disclosure
jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php...
CVE-2016-5429
jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php...
CVE-2016-5429
CVE-2016-5429 concerns the jose-php library prior to 2.2.1, where non-constant-time HMAC comparisons in the implementation (notably in JWE.php and JWS.php) can enable remote attackers to glean sensitive data via timing attacks. Public sources consistently state that the vulnerability enables info...
CVE-2016-5429: Exposure of Sensitive Information to an Unauthorized Actor
jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php...
PT-2016-6425
Name of the Vulnerable Software and Affected Versions jose-php versions prior to 2.2.1 Description The issue makes it easier for remote attackers to obtain sensitive information via a timing attack. This is related to the files JWE.php and JWS.php, where the software does not use constant-time...
MGASA-2016-0280 Updated openssh packages fix security vulnerability
The dosetupenv function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pamenvironment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as...
OpenSSH < 7.3 Multiple Vulnerabilities
According to its banner, the version of OpenSSH running on the remote host is prior to 7.3. It is, therefore, affected by multiple vulnerabilities : - A local privilege escalation when the UseLogin feature is enabled and PAM is configured to read .pamenvironment files from home directories...
Debian DLA-604-1 : ruby-actionpack-3.2 security update
Multiple vulnerabilities have been discovered in ruby-actionpack-3.2, a web-flow and rendering framework and part of Rails : CVE-2015-7576 A flaw was found in the way the Action Controller component compared user names and passwords when performing HTTP basic authentication. Time taken to compare...
[SECURITY] [DLA 604-1] ruby-actionpack-3.2 security update
Package : ruby-actionpack-3.2 Version : 3.2.6-6+deb7u3 CVE ID : CVE-2015-7576 CVE-2016-0751 CVE-2016-0752 CVE-2016-2097 CVE-2016-2098 CVE-2016-6316 Multiple vulnerabilities have been discovered in ruby-actionpack-3.2, a web-flow and rendering framework and part of Rails: CVE-2015-7576 A flaw was...
DLA-604-1 ruby-actionpack-3.2 - security update
Bulletin has no description...
Ubuntu 14.04 LTS / 16.04 LTS : OpenSSH vulnerabilities (USN-3061-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3061-1 advisory. Eddie Harari discovered that OpenSSH incorrectly handled password hashing when authenticating non-existing users. A remote attacker could...
Ubuntu: Security Advisory (USN-3061-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-3061-1 openssh vulnerabilities
Eddie Harari discovered that OpenSSH incorrectly handled password hashing when authenticating non-existing users. A remote attacker could perform a timing attack and enumerate valid users. CVE-2016-6210 Tomas Kuthan, Andres Rojas, and Javier Nieto discovered that OpenSSH did not limit password...
USN-3061-1: OpenSSH vulnerabilities
Eddie Harari discovered that OpenSSH incorrectly handled password hashing when authenticating non-existing users. A remote attacker could perform a timing attack and enumerate valid users. CVE-2016-6210 Tomas Kuthan, Andres Rojas, and Javier Nieto discovered that OpenSSH did not limit password...