openssl: multiple issues

CVE-2016-0702 private key extraction A side-channel attack was found that makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. An attacker who has the ability to control code in a thread running on the same hyper-threaded core as the victim's thread that is performing...

Ubuntu: Security Advisory (USN-2914-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS : OpenSSL vulnerabilities (USN-2914-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2914-1 advisory. Yuval Yarom, Daniel Genkin, and Nadia Heninger discovered that OpenSSL was vulnerable to a side-channel attack on modular exponentiation. On certain CPUs...

jenkins: HudsonPrivateSecurityRealm allows creation of reserved names (SECURITY-166)

It was discovered that the internal Jenkins user database did not restrict access to reserved names, allowing users to escalate privileges...

Authentication flaw

The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name...

Revived Wire Media PHP File Manager Username Backdoor

An attacker might use a backdoor which exists in PHP File Manager's user database. A successful exploitation might allow the attacker to create an administrator user on vulnerable installations or to run arbitrary code...

Moderate: Red Hat Security Advisory: mysql55-mysql security update

Updated mysql55-mysql packages that fix several security issues are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Cisco WebEx Meeting Center Web-Based Administrative Interface User Enumeration Vulnerability

A vulnerability in the web-based administrative interface of Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to enumerate valid usernames and determine if the usernames have administrative privileges. The vulnerability is due to a logic error in the handling of invalid...

IdeaCMS logic login bug, pass to kill 0day-vulnerability warning-the black bar safety net

Baidu keywords: Powered By IdeaCMS ! A successful landing ! You can also login does not exist the user ! Landing wooyunsec the user to the user database does not exist, you can still continue the landing） !...

deaCMS logic login bug, pass to kill 0day-vulnerability warning-the black bar safety net

Baidu keywords: Powered By IdeaCMS ! A successful landing ! You can also login does not exist the user Landing wooyunsec the user to the user database does not exist, you can still continue the landing）...

IdeaCMS built Station system universal vulnerability affects thousands of sites-vulnerability warning-the black bar safety net

IdeaCMS based on the ASP+MSSQL/ACCESS technology development from 2 0 0 8 released in the first version since, every year, we are on a program to do a larger version of the update, so far has released six major versions. IdeaCMS in a simple, efficient, flexible, easy to use, open source, template...

CVE-2014-9577

VDG Security SENSE formerly DIVA 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response...

Default credentials

VDG Security SENSE formerly DIVA 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response...

CVE-2014-9577

VDG Security SENSE formerly DIVA 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response...

Visual Mining NetCharts Server Remote Code Execution Exploit

This Metasploit module exploits multiple vulnerabilities in Visual Mining NetCharts. First, a lack of input validation in the administration console permits arbitrary jsp code upload to locations accessible later through the web service. Authentication is typically required, however a 'hidden' us...

ArubaOS 6.3.1.11 / 6.4.2.1 SSH Authentication Bypass

The version of ArubaOS has an unspecified vulnerability that allows a remote attacker to obtain limited administrative privileges without valid credentials. The vulnerability affects access over SSH. However, access through WebUI and the serial port is not affected, and the vulnerability does not...

List Site Pro 2.0 User Database Delimiter Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6685/info List Site PRO is a top site ranking system that counts hits from member sites and then ranks them according to the number of hits. A problem has been reported for List Site PRO that would allow an attacker to...

IISWorks FileMan fileman.mdb Remote User Database Disclosure

No description provided by source. Exploit Title: IISWorks FileMan fileman.mdb Remote User Database Disclosure Disclosure Date: July 5, 2005 Author: Known Vulnerability Software Link: http://www.scriptdungeon.com/scripts/asp/FileManASP.rar Version: OSVDB: 17824 Security Tracker ID: 1014383 Found...

Siteman 1.1 User Database Privilege Escalation Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/12304/info Siteman is reported prone to a vulnerability that may allow users to gain elevated privileges. This issue results from insufficient sanitization of user-supplied data. Apparently, an attacker can supply...

iSO Filer Lite 2.1.0 - Directory Traversal

No description provided by source. Exploit Title: Filer Lite v2.1.0 for iPhone / iPod touch, Directory Traversal Date: 02/24/2011 Author: R3d@l3rt, Sp@2K, Sunlight, H@ckk3y Software Link : http://itunes.apple.com/kr/app/filer-lite-download-view-manage/id350939597?mt=8 Version: 2.1.0 Tested on:...