Collaborate Disseminate
Bouncy Castle BKS version 1 keystore files use an HMAC that is only 16 bits long,which can allow an attacker to compromise the integrity of a BKS-V1 keystore. Continue reading VU#306792: Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions
Multiple SAML libraries may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature,allowing the attack to potentially bypass authentication to SAML service providers. Continue reading VU#475445: Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal
The Quagga BGP daemon bgpd prior to version 1.2.3 may be vulnerable to multiple issues that may result in denial of service,information disclosure,or remote code execution. Continue reading VU#940439: Quagga bgpd is affected by multiple vulnerabilities
The Quagga BGP daemon bpgd prior to version 1.2.3 may be vulnerable to multiple issues that may result in denial of service,information disclosure,or remote code execution. Continue reading VU#940439: Quagga bpgd is affected by multiple vulnerabilities
The Pulse Secure Linux client GUI fails to validate SSL certificates,which can allow an attacker to modify connection settings. Continue reading VU#319904: Pulse Secure Linux client GUI fails to validate SSL certificates
CPU hardware implementations are vulnerable to cache side-channel attacks. These vulnerabilities are referred to as Meltdown and Spectre. Continue reading VU#584653: CPU hardware vulnerable to side-channel attacks
TLS implementations may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding,and may therefore be vulnerable to Bleichenbacher-style attacks. This attack is known as a"ROBOT attack". Continue reading VU#144389: TLS implementations may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding
Apple MacOS High Sierra fails to properly require authentication for disabled accounts,such as root account,which can allow an authenticated user to obtain root privileges. Continue reading VU#113765: Apple MacOS High Sierra disabled account authentication bypass
Install Norton Security for Mac,prior to version 7.6,does not validate SSL certificates. Continue reading VU#681983: Install Norton Security for Mac does not verify SSL certificates
Install Norton Security for Mac,prior to version 7.6,does not validate SSL certificates. Continue reading VU#681983: Install Norton Security for Mac does not verify SSL certificates