CVE-2016-2522

CVE-2016-2522 affects the Wireshark ASN.1 BER dissector (epan/dissectors/packet-ber.c) in Wireshark 2.0.x before 2.0.2. The dissect_ber_constrained_bitstring function does not verify that a certain length is nonzero, enabling an attacker to cause a denial of service via a crafted packet (out-of-b...

Oracle: Security Advisory (ELSA-2011-1220)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-2522

Cross-site scripting XSS vulnerability in Microsoft SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via crafted content, aka "Microsoft SharePoint XSS Spoofing Vulnerability."...

CVE-2015-2522

CVE-2015-2522 affects Microsoft SharePoint Foundation 2013 SP1. A Cross-Site Scripting (XSS) vulnerability arises from inadequate sanitization of user-supplied content in SharePoint, allowing remote authenticated users to inject arbitrary script via crafted content. The root cause is improper san...

CVE-2015-2522

Cross-site scripting XSS vulnerability in Microsoft SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via crafted content, aka "Microsoft SharePoint XSS Spoofing Vulnerability."...

MS15-099: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3089664)

The remote Windows host has a version of Microsoft Office, Excel, Excel Viewer, SharePoint Server, Microsoft Office Compatibility Pack, Microsoft Office Web Apps, and/or Microsoft SharePoint Foundation installed that is affected by one or more of the following vulnerabilities : - Multiple remote...

Ubuntu: Security Advisory (USN-2522-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS : ICU vulnerabilities (USN-2522-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2522-1 advisory. It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker...

SOL15873 - cURL/libcURL vulnerability CVE-2014-2522

Recommended action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists. Supplemental...

openSUSE Security Update : mipv6d (openSUSE-SU-2010:0736-1)

the mipv6 daemon did not check the origin of netlink messages, therefore allowing local users to spoof messages CVE-2010-2522. remote attackers could cause buffer overflows in mipv6d CVE-2010-2523. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

openSUSE Security Update : ldapsmb (openSUSE-SU-2011:0998-1)

A Cross-Site Request Forgery CSRF and a Cross Site Scripting vulnerability have been fixed in samba's SWAT. CVE-2011-2522 and CVE-2011-2694 have been assigned. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

openSUSE Security Update : ldapsmb (openSUSE-SU-2011:0998-1)

A Cross-Site Request Forgery CSRF and a Cross Site Scripting vulnerability have been fixed in samba's SWAT. CVE-2011-2522 and CVE-2011-2694 have been assigned. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

CVE-2014-2522

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP...

CVE-2014-2522

CVE-2014-2522 affects curl/libcurl running on Windows with the SChannel/WinSSL TLS backend when accessing URLs using a numerical IP address. The root cause is that hostname verification against the certificate’s CN or subjectAltName is not performed, enabling MITM-style spoofing with an arbitrary...

CVE-2014-2522

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP...

CVE-2014-2522

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP...

Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : curl (SSA:2014-086-01)

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2014-086-01. The text itsel...

cURL/libcURL SSL证书验证安全限制绕过漏洞

BUGTRAQ ID: 66296 CVE ID: CVE-2014-2522 cURL是命令行传输文件工具，支持FTP、FTPS、HTTP、HTTPS、GOPHER、TELNET、DICT、FILE和LDAP。 cURL/libcURL在服务器证书的验证上存在安全漏洞，成功利用后可导致中间人攻击或服务器欺骗。 0 cURL 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://curl.haxx.se/...

Oracle Linux 6 : samba / and / cifs-utils (ELSA-2011-1221)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1221 advisory. - Security Release, fixes CVE-2011-2694, CVE-2011-2522 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Oracle Linux 5 : samba (ELSA-2011-1219)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1219 advisory. - Security Release, Add fix also for CVE-2011-2724 - Security Release, fixes CVE-2010-0547, CVE-2010-0787, CVE-2011-2694, CVE-2011-2522, CVE-2011-1678...