[SECURITY] [DSA 3796-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3796-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 26, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3796-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3796-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 26, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3796-1 (apache2 - security update)

Several vulnerabilities were discovered in the Apache2 HTTP server. CVE-2016-0736 RedTeam Pentesting GmbH discovered that modsessioncrypto was vulnerable to padding oracle attacks, which could allow an attacker to guess the session cookie. CVE-2016-2161 Maksim Malyutin discovered that malicious...

Medium: httpd24

Issue Overview: The following security-related issues were fixed: Padding oracle vulnerability in Apache modsessioncrypto CVE-2016-0736 DoS vulnerability in modauthdigest CVE-2016-2161 Apache HTTP request parsing whitespace defects CVE-2016-8743 Affected Packages: httpd24 Issue Correction: Run yu...

Fedora 25 : httpd (2016-8d9b62c784)

Security fix for CVE-2016-8743, CVE-2016-2161, CVE-2016-0736 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing addition...

Fedora 24 : httpd (2016-d22f50d985)

Security fix for CVE-2016-8743, CVE-2016-2161, CVE-2016-0736 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing addition...

Fedora Update for httpd FEDORA-2016-8d9b62c784

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] httpd

New httpd packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/httpd-2.4.25-i586-1slack14.2.txz: Upgraded. This update fixes the following security issues: CVE-2016-8740: modhttp2:...

Apache mod_session_crypto - Padding Oracle

Apache modsessioncrypto - Padding Oracle ''' Advisory: Padding Oracle in Apache modsessioncrypto During a penetration test, RedTeam Pentesting discovered a Padding Oracle vulnerability in modsessioncrypto of the Apache web server. This vulnerability can be exploited to decrypt the session data an...

Apache mod_session_crypt 2.5 Padding Oracle

Advisory: Padding Oracle in Apache modsessioncrypto During a penetration test, RedTeam Pentesting discovered a Padding Oracle vulnerability in modsessioncrypto of the Apache web server. This vulnerability can be exploited to decrypt the session data and even encrypt attacker-specified data. Detai...

CVE-2015-0736

Cross-site request forgery CSRF vulnerability in Cisco MediaSense 10.51 and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu16728...

CVE-2015-0736

Cisco MediaSense is affected by a Cross‑Site Request Forgery (CSRF) vulnerability in version 10.5(1) and earlier. The root cause is insufficient CSRF protections on the web interface, enabling an attacker to hijack the authentication of an authenticated user and perform actions in that user’s con...

CVE-2014-0736

Cross-site request forgery CSRF vulnerability in the Call Detail Records Analysis and Reporting CAR page in Cisco Unified Communications Manager Unified CM 10.01 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make CAR modifications, aka Bug I...

CVE-2014-0736

Cisco Unified Communications Manager (Unified CM) is affected by CSRF on the CAR page, for 10.0(1) and earlier. An attacker can trick a logged-in user into issuing CAR-modification requests, potentially hijacking the user’s authentication for those actions. The issue is addressed in Cisco’s advis...

CVE-2013-0736

Multiple cross-site request forgery CSRF vulnerabilities in the Mingle Forum plugin 1.0.34 and possibly earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 modify user privileges or 2 conduct cross-site scripting XSS attacks via...

CVE-2013-0736

Multiple cross-site request forgery CSRF vulnerabilities in the Mingle Forum plugin 1.0.34 and possibly earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 modify user privileges or 2 conduct cross-site scripting XSS attacks via...

CVE-2013-0736

The CVE-2013-0736 issue affects the WordPress Mingle Forum plugin up to 1.0.34. Descriptions in multiple sources indicate multiple CSRF flaws that allow an attacker to hijack an administrator’s session to perform privileged actions (e.g., modify user privileges) or trigger XSS via unspecified vec...

CVE-2012-0736

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 are affected by a vulnerability where improper scan job creation allows a remote attacker to execute arbitrary code via a crafted web site. The issue stems from incorrect scan job creation logic. A patch is available: upgrade to IBM Ratio...

CVE-2011-0736

Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this issue because the...

CVE-2011-0736

Adobe ColdFusion 9.0.1 CHF1 and earlier: when a web app uses a DBMS, remote attackers can cause information disclosure of database structure via an id=- query to a .cfm file. The vendor disputes severity; mitigation advised by ColdFusion Lockdown guide is proper Site-wide Error Handler and Debug ...