Timing attack on the password reset - ownCloud

The "Lost Password" implementation is vulnerable to a Remote Timing Attack. The token used to secure the password reset is fetched from the database and compared to the user-specified value using the equals operator. An attacker successfully rebuilding the token can then specify an arbitrary...

Session fixation

The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service application crash via a crafted application that uses a PDO driver for a fetch and then calls the sessionstart function, as demonstrated by...

Moderate: Red Hat Security Advisory: squirrelmail security update

An updated squirrelmail package that fixes several security issues is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports

The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number...

CVE-2011-4894

Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections...

CVE-2011-4894

Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections...

Code injection

Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections...

View PDF Macro in Office Connector makes http fetch from Adobe from https session

The View PDF macro within the Office Connector plugin provides the following http URL even for https sessions when a user's browser fails the Flash installed test. http://www.adobe.com/images/shared/downloadbuttons/getflashplayer.gif It's bad form to mix http urls in with secured https sessions a...

DEBIAN-CVE-2010-4722

Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors...

CVE-2010-4722

Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors...

CVE-2010-4722

Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors...

Design/Logic Flaw

Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors...

CVE-2010-4722

Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors...

CVE-2010-4722

Technical details about CVE-2010-4722 are not provided in the supplied documents. No affected products, vectors, or remediation are specified here. Monitor for updates from vendors and security advisories.

CVE-2010-4722

Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors...

CVE-2010-4722: Undefined Security Weakness

Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors...

SLAD snort

This script connects to SLAD on a remote host to fetch the SNORT results. To work properly, this script requires to be provided with a valid SSH login by means of an SSH key with pass- phrase if the SSH public key is passphrase-protected, or a password to log in. OpenVAS Vulnerability Test Fetch...

Fedora 12 : squirrelmail-1.4.20-3.fc12 (2010-10244)

Tue Jun 22 2010 Michal Hlavinka - 1.4.20-3 - fix CVE-2010-1637 : mail fetch plugin's port-scans via non-standard POP3 server ports - Mon Jun 7 2010 Michal Hlavinka - 1.4.20-2 - add note to config file that https connections are forced by default - Mon Mar 8 2010 Michal Hlavinka - 1.4.20-1 -...

Fedora 11 : squirrelmail-1.4.20-2.fc11 (2010-10264)

Tue Jun 22 2010 Michal Hlavinka - 1.4.20-2 - fix CVE-2010-1637 : mail fetch plugin's port-scans via non-standard POP3 server ports - Mon Mar 8 2010 Michal Hlavinka - 1.4.20-1 - updated to 1.4.20 - translations updated - Thu Sep 17 2009 Michal Hlavinka - 1.4.20-0.rc2.20100104 - updated to...

Mandriva Update for squirrelmail MDVSA-2010:120 (squirrelmail)

Check for the Version of squirrelmail OpenVAS Vulnerability Test Mandriva Update for squirrelmail MDVSA-2010:120 squirrelmail Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or...