SEC Consult SA-20191125-0 :: FortiGuard XOR Encryption in Multiple Fortinet Products From: SEC Consult Vulnerability Lab <research () sec-consult com> Date: Mon, 25 Nov 2019 14:43:45 +0100 SEC Consult Vulnerability Lab Security Advisory < 20191125-0 > ======================================================================= title: FortiGuard XOR Encryption product: Multiple Fortinet Products (see Vu

CVE-2017-8301: TLS verification vulnerability in LibreSSL 2.5.1 - 2.5.3 From: Jakub Jirutka <jakub () jirutka cz> Date: Thu, 27 Apr 2017 20:58:10 +0200 Vulnerability Type: Missing TLS Certificate Validation Affected Product Code Base: LibreSSL - 2.5.1 - 2.5.3 Vendor of Product: OpenBSD Affected Component: SSL_set_verify, SSL_CTX_set_verify, SSL_get_verify_result ## Summary LibreSSL 2.5.1 to 2.5.3

Forwarding issues related to MACs starting with a 4 or a 6 (Was: [c-nsp] Wierd MPLS/VPLS issue) From: Job Snijders <job () instituut net> Date: Fri, 2 Dec 2016 15:32:13 +0100 Hi all, Ever since the IEEE started allocating OUIs (MAC address ranges) in a randomly distributed fashion rather then sequentially, the operator community has suffered enormously. Time after time issues pop up related to MAC

opensshd - user enumeration From: "Harari, Eddie" <EddieEzra.Harari () verint com> Date: Thu, 14 Jul 2016 10:12:45 +0000 Sorry for the resend, I change the format of the email to better fit the list... -------------------------------------------------------------------- User Enumeration using Open SSHD (<=Latest version). ------------------------------------------------------------------- Abstract

SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7 From: <operator8203 () runbox com> Date: Sat, 09 Jan 2016 14:48:01 -0500 (EST) #!/usr/bin/env python # SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7 # Usage: ./fgt_ssh_backdoor.py <target-ip> import socket import select import sys import paramiko from paramiko.py3compat import u import base64 import hashlib import termios import tty def

Xen Security Advisory 138 (CVE-2015-5154) - QEMU heap overflow flaw while processing certain ATAPI commands. From: Xen.org security team <security () xen org> Date: Mon, 27 Jul 2015 12:03:06 +0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Xen Security Advisory CVE-2015-5154 / XSA-138 version 2 QEMU heap overflow flaw while processing certain ATAPI commands. UPDATES IN VERSION 2 ===============

CVE-request: systemd-resolved DNS cache poisoning From: Sebastian Krahmer <krahmer () suse de> Date: Wed, 12 Nov 2014 12:15:56 +0100 Hi systemd-resolved contains a caching resolver, which has to be enabled via /etc/nsswitch.conf in order to be integrated. Any local name resolvings via getaddrinfo() etc. are then routed via DBUS to systemd-resolved which resolves the name and caches it according to

Re: [SECURITY] [DSA 2826-1] denyhosts security update From: Helmut Grohne <helmut () subdivi de> Date: Sun, 22 Dec 2013 19:51:29 +0100 On Sun, Dec 22, 2013 at 07:26:15PM +0100, Yves-Alexis Perez wrote: Helmut Grohne discovered that denyhosts, a tool preventing SSH brute-force attacks, could be used to perform remote denial of service against the SSH daemon. Incorrectly specified regular expression

PayPal.com XSS Vulnerability From: Robert Kugler <robert.kugler10 () gmail com> Date: Fri, 24 May 2013 18:38:44 +0200 Hello all! I'm Robert Kugler a 17 years old German student who's interested in securing computer systems. I would like to warn you that PayPal.com is vulnerable to a Cross-Site Scripting vulnerability! PayPal Inc. is running a bug bounty program for professional security researcher

Security vulnerability in MySQL/MariaDB sql/password.c From: Sergei Golubchik <serg () montyprogram com> Date: Sat, 9 Jun 2012 17:30:38 +0200 Hi We have recently found a serious security bug in MariaDB and MySQL. So, here, we'd like to let you know about what the issue and its impact is. At the end you can find a patch, in case you need to patch an older unsuported MySQL version. All MariaDB and M

FreeBSD Security Advisory FreeBSD-SA-12:02.crypt From: FreeBSD Security Advisories <security-advisories () freebsd org> Date: Wed, 30 May 2012 12:47:51 GMT -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-12:02.crypt Security Advisory The FreeBSD Project Topic: Incorrect crypt() hashing Category: core Module: lib