Ilch CMS 2.0 Cross Site Scripting

Advisory ID: HTB23203 Product: Ilch CMS Vendor: http://ilch.de Vulnerable Versions: 2.0 and probably prior Tested Version: 2.0 Advisory Publication: February 12, 2014 without technical details Vendor Notification: February 12, 2014 Public Disclosure: March 5, 2014 Vulnerability Type: Cross-Site...

Ilch CMS 2.0 - Persistent Cross-Site Scripting

Advisory ID: HTB23203 Product: Ilch CMS Vendor: http://ilch.de Vulnerable Versions: 2.0 and probably prior Tested Version: 2.0 Advisory Publication: February 12, 2014 without technical details Vendor Notification: February 12, 2014 Public Disclosure: March 5, 2014 Vulnerability Type: Cross-Site...

Cross-Site Scripting (XSS) in Ilch CMS

High-Tech Bridge Security Research Lab discovered vulnerability in Ilch CMS, which can be exploited to perform Cross-Site Scripting XSS attacks against users and administrators of vulnerable application. 1 Cross-Site Scripting XSS in Ilch CMS: CVE-2014-1944 The vulnerability exists due to...

ESXi 5.0 < Build 764879 Multiple Vulnerabilities (remote check)

The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities : - Errors exist in the Libxml2 library functions 'xmlXPathNextPrecedingSibling', 'xmlNodePtr' and 'xmlXPathNextPrecedingInternal' that could allow denial of service attacks or arbitrary code execution...

Ubuntu Update for linux USN-1944-1

Check for the Version of linux OpenVAS Vulnerability Test $Id: gbubuntuUSN19441.nasl 8448 2018-01-17 16:18:06Z teissa $ Ubuntu Update for linux USN-1944-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; y...

Fedora Update for curl FEDORA-2013-11574

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 5 / 6 : curl (ELSA-2013-0771)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0771 advisory. 7.19.7-36 - fix cookie tailmatching to prevent cross-domain leakage CVE-2013-1944 Tenable has extracted the preceding description block directly from the...

Medium: curl

Issue Overview: The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. Affected Packages: curl Issue Correction: Run yum update...

Oracle Linux 6 : mingw32-libxml2 (ELSA-2013-0217)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0217 advisory. - Added patch for CVE-2012-0841 - Added patch for CVE-2011-0216 - Added patch for CVE-2011-2834 - Added patch for CVE-2011-3919 - Added patch for...

SuSE 10 Security Update : libcurl4 (ZYPP Patch Number 8618) (BEAST)

This update of curl fixes several security issues : - libcurl URL decode buffer boundary flaw. bnc824517 / CVE-2013-2174 - cookie domain tailmatch. bnc814655 / CVE-2013-1944 - curl sets SSLOPALL. bnc742306 / CVE-2011-3389 - When SSLOPNETSCAPEREUSECIPHERCHANGEBUG is enabled, does not properly...

SuSE 10 Security Update : compat-curl2 (ZYPP Patch Number 8557)

This update of compat-curl2 fixes several security issues. - fixes for the cookie domain tailmatch vulnerability. bnc814655 - updated curl CA-Cert Bundle. bnc810010 - fixes for a potential BEAST attack bnc742306 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this...

SuSE 11.2 Security Update : curl (SAT Patch Number 7633)

This update fixes the cookie domain tailmatch vulnerability in curl. CVE-2013-1944 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is...

SuSE 10 Security Update : curl, curl (ZYPP Patch Number 8550)

This update fixes the cookie domain tailmatch vulnerability in curl. CVE-2013-1944 has been assigned to this issue. Also the CA-Cert Bundle has been updated to the current state. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

Fedora 18 : curl-7.27.0-9.fc18 (2013-6766)

prevent an artificial timeout event due to stale speed-check data 906031 - show proper host name on failed resolve 957173 fix cookie tailmatching to prevent cross-domain leakage CVE-2013-1944 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Fedora 19 : curl-7.29.0-6.fc19 (2013-6780)

prevent an artificial timeout event due to stale speed-check data 906031 - show proper host name on failed resolve 957173 fix cookie tailmatching to prevent cross-domain leakage CVE-2013-1944 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

CVE-2013-1944

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL...

CVE-2013-1944

CVE-2013-1944 is the tailMatch cookie handling flaw in curl/curl/libcurl where the tailMatch function in cookie.c does not correctly match path domains, allowing cookie leakage via suffix matches in URLs. Affected are curl and libcurl versions before 7.30.0. Multiple connected advisories (e.g., M...

Scientific Linux Security Update : curl on SL5.x, SL6.x i386/x86_64 (20130424)

A flaw was found in the way libcurl matched domains associated with cookies. This could lead to cURL or an application linked against libcurl sending the wrong cookie if only part of the domain name matched the domain associated with the cookie, disclosing the cookie to unrelated hosts...

CentOS Update for curl CESA-2013:0771 centos6

Check for the Version of curl OpenVAS Vulnerability Test CentOS Update for curl CESA-2013:0771 centos6 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CentOS 5 / 6 : curl (CESA-2013:0771)

Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...