USN-612-10: OpenVPN regression

USN-612-3 addressed a weakness in OpenSSL certificate and key generation in OpenVPN by adding checks for vulnerable certificates and keys to OpenVPN. A regression was introduced in OpenVPN when using TLS with password protected certificates which caused OpenVPN to not start when used with...

USN-612-9: openssl-blacklist update

USN-612-3 addressed a weakness in OpenSSL certificate and key generation in OpenVPN by introducing openssl-blacklist to aid in detecting vulnerable private keys. This update enhances the openssl-vulnkey tool to check Certificate Signing Requests, accept input from STDIN, and check moduli without ...

OtomiGenX v2.2 Ultimate Authentication bypass Vulnerability

...::::: OtomiGenX v2.2 Ultimate Authentication bypass Vulnerabilities ::::.... Virangar Security Team www.virangar.net www.virangar.ir -------- Discoverd By :virangar security teamhadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all virangar members & all hackerz greetz:to my be...

LokiCMS Multiple Vulnerabilities through Authorization weakness

Title: LokiCMS Multiple Vulnerabilities through Authorization weakness Vendor: http://www.lokicms.com Bugs: Arbitrary File Overwrite,Code Injection,File Inclusion,Retrieve Admin's Hash Vulnerable Version: LokiCMS 0.3.4 prior versions also may be affected Exploitation: Remote with browser Impact:...

perl-Crypt-CBC weaker encryption with some ciphers

Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector IV of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael...

Debian OpenSSH/OpenSSL Package Random Number Generator Weakness (SSL check)

The remote x509 certificate on the remote SSL server has been generated on a Debian or Ubuntu system which contains a bug in the random number generator of its OpenSSL library. The problem is due to a Debian packager removing nearly all sources of entropy in the remote version of OpenSSL. An...

Debian and Ubuntu OpenSSL packages contain a predictable random number generator

Overview A vulnerability in the OpenSSL package included with the Debian GNU/Linux operating system and its derivatives may cause weak cryptographic keys to be generated. Description A weakness exists in the random number generator used by the OpenSSL package included with the Debian GNU/Linux...

USN-612-6: OpenVPN regression

USN-612-3 addressed a weakness in OpenSSL certificate and keys generation in OpenVPN by adding checks for vulnerable certificates and keys to OpenVPN. A regression was introduced in OpenVPN when using TLS, multi-client/server mode, and specifying a user or group which caused OpenVPN to not start...

[USN-612-1] OpenSSL vulnerability

=========================================================== Ubuntu Security Notice USN-612-1 May 13, 2008 openssl vulnerability CVE-2008-0166 =========================================================== A weakness has been discovered in the random number generator used by OpenSSL on Debian and...

Debian OpenSSH/OpenSSL Package Random Number Generator Weakness

The remote SSH host key has been generated on a Debian or Ubuntu system which contains a bug in the random number generator of its OpenSSL library. The problem is due to a Debian packager removing nearly all sources of entropy in the remote version of OpenSSL. An attacker can easily obtain the...

Microsoft Internet Explorer 2 - UTF-7 HTTP Response Handling

Microsoft Internet Explorer 2 - UTF-7 HTTP Response Handling source: https://www.securityfocus.com/bid/29112/info Microsoft Internet Explorer is prone to a weakness that can facilitate cross-site scripting attacks. The issue occurs because the application fails to sufficiently sanitize...

PT-2008-3624 · Php +1 · Php +1

Name of the Vulnerable Software and Affected Versions: PHP versions 4.x through 4.4.7 PHP versions 5.x through 5.2.4 Description: The issue arises from the GENERATE SEED macro, which, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion...

Solaris ypupdated Command Execution

This exploit targets a weakness in the way the ypupdated RPC application uses the command shell when handling a MAP UPDATE request. Extra commands may be launched through this command shell, which runs as root on the remote host, by passing commands in the format '|'. Vulnerable systems include...

Sun Solaris <= 10 rpc.ypupdated Remote Root Exploit (meta)

No description provided by source. / \ / \ | | | | ----====/ /\/ /\ | || |====---- | | | || | | | | | | | | | | | | |...

BSD (Multiple Distributions) - 'strfmon()' Integer Overflow

// source: https://www.securityfocus.com/bid/28479/info Multiple BSD platforms are prone to an integer-overflow weakness. An attacker can exploit this issue through other applications such as PHP to execute arbitrary code within the context of the affected application. Failed exploit attempts wil...

DNN (DotNetNuke) Upgrade Process ValidationKey Generation Weakness Privilege Escalation

The version of DNN installed on the remote host appears to be using a default machine key, both 'ValidationKey' and 'DecryptionKey', for authentication token encryption and validation. A remote attacker can leverage this issue to bypass authentication and gain administrative access to the affecte...

CVE-2008-1396

Plone CMS 3.x uses invariant data a client username and a server secret when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network...

Weak initial sequence number generation

Weak initial sequence number generation allows to spoof TCP connection...

Debian Security Advisory DSA 1305-1 (icedove)

The remote host is missing an update to icedove announced via advisory DSA 1305-1. OpenVAS Vulnerability Test $Id: deb13051.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1305-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian: Security Advisory (DSA-1305-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...