libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a “bits/bytes confusion bug.”
Monthly Archives: April 2016
CVE-2016-0757
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
CVE-2016-0787
The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a “bits/bytes confusion bug.”
CVE-2016-2313
auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database.
British Authorities Order Hacker Lauri Love to hand Over Encryption Keys
The National Crime Agency (NCA) of United Kingdom is forcing the British citizen, and political hacktivist Lauri Love accused of hacking to hand over encryption keys to equipment seized from his home.
Love, 31, is currently fighting extradition to the United States where he faces up to 99 years in prison for allegedly hacking into the Federal Bureau Investigation (FBI), the US Missile
Cisco Releases Security Update
Original release date: April 13, 2016
Cisco has released a security update to address a vulnerability in its Cisco Unified Computing System (UCS) Central Software. Exploitation of this vulnerability could allow a remote attacker to take control of an affected system.
US-CERT encourages users and administrators to review the Cisco Security Advisory and apply the necessary update.
This product is provided subject to this Notification and this Privacy & Use policy.
Qbot Malware Morphs Quickly to Evade Detection
Researchers spot new wave of Qbot infections that can shape-shift every six hours to evade detection.
CVE-2015-8807
Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.
CVE-2016-0740
Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.
CVE-2016-0775
Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.