CVSS: 5.1EPSS: 0%CPEs: 25EXPL: 0CVE-2013-1620 – nss: TLS CBC padding timing attack
https://notcve.org/view.php?id=CVE-2013-1620
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. La implementación en Mozilla Network Security Services (NSS) de TLS no tiene debidamente en cuenta tiempos de canal lateral ataques a una operación de comprobación de incumplimiento MAC durante el procesamiento de malformaciones relleno CBC, que permite a atacantes remotos para realizar ataques distintivos y los ataques de recuperación de texto plano-a través de análisis estadístico de datos de tiempo de los paquetes hechos a mano, una cuestión relacionada con CVE-2013-0169. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html http://openwall.com/lists/oss-security/2013/02/05/24 http://rhn.redhat.com/errata/RHSA-2013-1135.html http://rhn.redhat.com/errata/RHSA-2013-1144.html http://seclists.org/fulldisclosure/2014/Dec/23 http://security.gentoo.org/glsa/glsa-201406-19.xml http://www. • CWE-203: Observable Discrepancy •
CVSS: 5.0EPSS: 1%CPEs: 2EXPL: 0CVE-2012-1738
https://notcve.org/view.php?id=CVE-2012-1738
Unspecified vulnerability in the Oracle iPlanet Web Server component in Oracle Sun Products Suite Java System Web Server 6.1 and Oracle iPlanet Web Server 7.0 allows remote attackers to affect availability via unknown vectors related to Web Server. Vulnerabilidad no especificada en el componente Oracle iPlanet Web Server en Oracle Sun Products Suite Java System Web Server v6.1 y Oracle iPlanet Web Server v7.0 permite a atacantes remotos afectar a la disponibilidad a través de vectores desconocidos relacionados con el servidor Web. • http://osvdb.org/83974 http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html http://www.securityfocus.com/bid/54515 http://www.securitytracker.com/id?1027276 https://exchange.xforce.ibmcloud.com/vulnerabilities/77058 •
CVSS: 7.5EPSS: 4%CPEs: 11EXPL: 4CVE-2002-1654
https://notcve.org/view.php?id=CVE-2002-1654
iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command, which provides a distinct attack vector and may make it easier to conduct brute force password guessing without detection. • http://lists.virus.org/vulnwatch-0201/msg00008.html http://securitytracker.com/id?1003157 http://www.kb.cert.org/vuls/id/985347 http://www.kb.cert.org/vuls/id/AAMN-567NFX http://www.procheckup.com/vulnerabilities/pr0105.html http://www.securiteam.com/securitynews/5IP0G0060Q.html http://www.securityfocus.com/bid/3831 https://exchange.xforce.ibmcloud.com/vulnerabilities/7845 •