CVSS: 5.0EPSS: 97%CPEs: 147EXPL: 1CVE-2014-3566 – SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack
https://notcve.org/view.php?id=CVE-2014-3566
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. El protocolo SSL 3.0, utilizado en OpenSSL hasta 1.0.1i y otros productos, utiliza relleno (padding) CBC no determinístico, lo que facilita a los atacantes man-in-the-middle obtener datos de texto plano a través de un ataque de relleno (padding) oracle, también conocido como el problema "POODLE". A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw allows a man-in-the-middle (MITM) attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections. • https://github.com/mikesplain/CVE-2014-3566-poodle-cookbook ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc http://advisories.mageia.org/MGASA-2014-0416.html http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html http://askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566 http& • CWE-310: Cryptographic Issues CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2013-5827
https://notcve.org/view.php?id=CVE-2013-5827
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Storage Management. Vulnerabilidad no especificada en el componente Enterprise Manager Base Platform en Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 y 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, y 11.2.0.3; y EM Plugin para DB 12.1.0.2 que permite a atacantes remotos afectar la integridad a través de vectores desconocidos relacionados con la gestión de almacenamiento. • http://secunia.com/advisories/55322 http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2013-5828
https://notcve.org/view.php?id=CVE-2013-5828
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.2 and 12.1.0.3 allows remote attackers to affect integrity via unknown vectors related to Storage Management. Vulnerabilidad no especificada en el componente Enterprise Manager Base Platform de Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 y 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, y 11.2.0.3; y EM Plugin para DB 12.1.0.2 y 12.1.0.3 permite a atacantes remotos afectar la integridad a través de vectores desconocidos relacionados con Storage Management. • http://secunia.com/advisories/55322 http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2013-3762
https://notcve.org/view.php?id=CVE-2013-3762
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.2, 12.1.0.3, and 12.1.0.4 allows remote attackers to affect integrity via unknown vectors related to Schema Management. Vulnerabilidad sin especificar en el componente Enterprise Manager Base Platform de Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 y 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, y 11.2.0.3; y EM Plugin for DB 12.1.0.2, 12.1.0.3, y 12.1.0.4 permite a atacantes remotos afectar la integridad a través de vectores relacionados con Schema Management. • http://secunia.com/advisories/55322 http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2013-5766
https://notcve.org/view.php?id=CVE-2013-5766
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.2 and 12.1.0.3 allows remote attackers to affect integrity via unknown vectors related to DB Performance Advisories/UIs. Vulnerabilidad no especificada en el componente Enterprise Manager Base Platform de Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 y 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, y 11.2.0.3; y EM Plugin para DB 12.1.0.2 y 12.1.0.3 permite a atacantes remotos afectar la integridad a través de vectores desconocidos relacionados con DB Performance Advisories/UIs. • http://secunia.com/advisories/55322 http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html •