Monthly Archives: December 2015

Debian

DSA-3417 bouncycastle – security update

Tibor Jager, Jörg Schwenk, and Juraj Somorovsky, from Horst Görtz
Institute for IT Security, published a paper in ESORICS 2015 where they
describe an invalid curve attack in Bouncy Castle Crypto, a Java library
for cryptography. An attacker is able to recover private Elliptic Curve
keys from different applications, for example, TLS servers.

Full Disclosure

Symphony 2.6.3 – Multiple Persistent Cross-Site Scripting Vulnerabilities

Posted by CSW Research Lab on Dec 13

================================================================
Symphony 2.6.3 – Multiple Persistent Cross-Site Scripting Vulnerabilities
================================================================

Information
**********************

Vulnerability Type : Multiple Persistent Cross Site Scripting
Vulnerabilities
Vulnerable Version : 2.6.3
Severity: Medium
Author – Arjun Basnet
CVE-ID: N/A
Homepage: *http://www.getsymphony.com/ <…