docpad-plugin-posteditor (>=2.0.0, <=2.1.2) potentially affected by CVE-2014-8881 via bleach (0.3.0)

bleach NPM version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - docpad-plugin-posteditor =2.0.0, =2.1.2 Source cves: CVE-2014-8881 Source advisory: OSV:GHSA-MVMF-CVFX-QG55...

@w3sec/goof (1.1.0), door (>=0.0.5, <=0.0.6) +5 more potentially affected by CVE-2014-3744 via st (>=0.0.12, <=0.2.4)

st NPM version =0.0.12, =0.0.5, =1.0.0, =0.0.0, =0.0.0-a10, =0.1.0, =0.0.1, =0.0.12 Source cves: CVE-2014-3744 Source advisory: OSV:GHSA-69RR-WVH9-6C4Q...

butchershop (0.1.0-pre), grunt-butchershop (0.2.1) +2 more potentially affected by CVE-2014-4671 via hapi (6.0.2)

hapi NPM version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on hapi and may be impacted: - butchershop 0.1.0-pre - grunt-butchershop 0.2.1 - hapi-level =0.0.3, =0.0.7 - rutha-utils 0.1.0 Source cves: CVE-2014-4671 Source advisory:...

Debian: Security Advisory (DLA-2356-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2356-1] freerdp security update

Debian LTS Advisory DLA-2356-1 [email protected] https://www.debian.org/lts/security/ Mike Gabriel August 30, 2020 https://wiki.debian.org/LTS Package : freerdp Version : 1.1.0git20140921.1.440916e+dfsg1-13+deb9u4 CVE ID : CVE-2014-0791 CVE-2020-11042 CVE-2020-11045 CVE-2020-11046...

Security Bulletin: CVE-2014-3577 HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name

Summary CVE-2014-3577 HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name Vulnerability Details CVEID: CVE-2014-3577 DESCRIPTION: Apache HttpComponents could allow a remote attacker to conduct spoofing...

lwIP TCP/IP Stack DNS Resolver <= 1.4.1 Cache-Poisoning Attack Vulnerability

The lwIP TCP/IP Stack DNS Resolver is vulnerable against a cache-poisoning attack. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

nacionaldefiadores.com Cross Site Scripting vulnerability OBB-1241049

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Security Bulletin: Novalink is impacted by Man in the middle vulnerability in WebSphere Application Server Liberty (CVE-2014-3603)

Summary Novalink uses WebSphere Application Server Liberty. There is a man in the middle vulnerability in WebSphere Application Server Liberty. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2014-3603 DESCRIPTION: Shibboleth Identity Provider IdP and OpenSAML Java could...

Microsoft Windows Unsafe Handling Practices Vulnerability

This post outlines multiple unsafe practices in Microsoft Windows that can allow for local privilege escalation. This multi-part post can be read even without a MIME-compliant program! Back in 2014, I reported a vulnerability in CreateProcess's handling of .cmd and .bat files that Microsoft fixed...

Microsoft Windows Unsafe Handling Practices

Hi @ll, This multi-part post can be read even without a MIME-compliant program! Back in 2014, I reported a vulnerability in CreateProcess's handling of .cmd and .bat files that Microsoft fixed with MS14-019 alias MSKB 2922229 and assigned CVE-2014-0315: command lines with a batch script as first...

edojudiciary.gov.ng Improper Access Control vulnerability OBB-1237877

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect Sterling Connect:Express for UNIX (CVE-2015-4000, CVE-2014-8176, CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)

Summary OpenSSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. This includes Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol CVE-2015-4000. OpenSSL is used by Sterling Connect:Express for UNIX. Sterling Connect:Express for UNIX has...

Security Bulletin: Vulnerabilities in OpenSSL affect Sterling Connect:Express for UNIX (CVE-2014-3513, CVE-2014-3567, CVE-2014-3570, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0205 and CVE-2015-0206)

Summary OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 and January 8, 2015 by the OpenSSL Project. OpenSSL is used by Sterling Connect:Express for UNIX. Sterling Connect:Express for UNIX has addressed the applicable CVEs and include...

Security Bulletin: Vulnerability in SSLv3 affects IBM Sterling Connect:Direct FTP+ (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled by default in Connect:Direct FTP+. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain...

Security Bulletin: TLS padding vulnerability affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Sterling Connect:Direct for Microsoft Windows. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain...

Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows CPU utilization (CVE-2014-0963)

Summary IBM Sterling Connect:Direct for Microsoft Windows is affected by a problem related to the SSL implementation which, under very specific conditions, can cause CPU utilization to rapidly increase. Vulnerability Details CVE ID: CVE-2014-0963 DESCRIPTION: IBM Sterling Connect:Direct for...

Security Bulletin: Vulnerability in SSLv3 affects IBM Sterling Connect:Direct for i5/OS (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Sterling Connect:Direct for i5/OS. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain...

Security Bulletin: Vulnerability in SSLv3 affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Sterling Connect:Direct for Microsoft Windows. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attack...

Security Bulletin: IBM Sterling Connect:Direct for UNIX is affected by the following OpenSSL vulnerabilities: CVE-2014-0224

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients an...