Fedora Update for kernel FEDORA-2010-11462

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Linux Kernel CIFS DNS查询缓存投毒漏洞

BUGTRAQ ID: 41904 CVE ID: CVE-2010-2524 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的CIFS DNS解析器机制没有正确地限制对密钥环存储查询结果的访问，如果随机用户通过addkey向密钥环中添加了结果记录然后又调用了CIFS CFS的话，就可以安装恶意的重新定向，诱骗用户从恶意的服务器加载系统。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2009-2524

Integer underflow in the NTLM authentication feature in the Local Security Authority Subsystem Service LSASS in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote attackers to cause a deni...

CVE-2009-2524

CVE-2009-2524 refers to an Integer Overflow in LSASS during NTLM authentication in multiple Windows versions. A malformed NTLM packet can cause LSASS to crash and reboot the host, i.e., a denial-of-service condition. Affected software includes Windows XP SP2/SP3, Windows Server 2003 SP2, Windows ...

Microsoft LSASS Authentication Process Integer Overflow (MS09-059; CVE-2009-2524)

LSASS provides an interface for managing local security, domain authentication, and Active Directory service processes. It handles authentication for the client and for the server. An elevation of privilege vulnerability has been discovered in the Microsoft Windows Local Security Authority...

CVE-2008-2524

BlogPHP 2.0 contains an authentication bypass vulnerability where a remote attacker can set a modified blogphp_username cookie to post messages or comments as an arbitrary user. Root cause: cookie field manipulation bypasses login checks. Affected product: BlogPHP 2.0. Practical impact: unauthori...

Debian Security Advisory DSA 1299-1 (ipsec-tools)

The remote host is missing an update to ipsec-tools announced via advisory DSA 1299-1. OpenVAS Vulnerability Test $Id: deb12991.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1299-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

openSUSE 10 Security Update : otrs (otrs-3544)

This update fixes a cross site scripting XSS vulnerability in OTRS CVE-2007-2524. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update otrs-3544. The text description of this plugin is C SUSE LLC...

Debian DSA-1298-1 : otrs2 - missing input sanitising

It was discovered that the Open Ticket Request System performs insufficient input sanitising for the Subaction parameter, which allows the injection of arbitrary web script code. The oldstable distribution sarge doesn't include otrs2. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

[SECURITY] [DSA 1298-1] New otrs2 packages fix cross-site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 1298-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 28th, 2007 http://www.debian.org/security/faq -...

[Full-disclosure] [SECURITY] [DSA 1298-1] New otrs2 packages fix cross-site scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1298-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 28th, 2007 http://www.debian.org/security/faq -...

CVE-2007-2524

Cross-site scripting XSS vulnerability in index.pl in Open Ticket Request System OTRS 2.0.x allows remote attackers to inject arbitrary web script or HTML via the Subaction parameter in an AgentTicketMailbox Action. NOTE: DEBIAN:DSA-1299 originally used this identifier for an ipsec-tools issue, b...

CVE-2007-2524

CVE-2007-2524 describes a cross-site scripting (XSS) vulnerability in the Open Ticket Request System (OTRS) 2.0.x. The flaw occurs in the index.pl script via the Subaction parameter in an AgentTicketMailbox Action, enabling an attacker to inject arbitrary web script or HTML. The connected OSS/NSS...

CVE-2006-2524

CVE-2006-2524 is an XSS vulnerability in UseBB 1.0 RC1 and earlier . The issue allows remote attackers to inject arbitrary script/HTML via unspecified vectors when processing the user date format. According to NVD, the CVSSv2 base score is 6.8 (Medium) with partial confidentiality, integrity, and...

CVE-2005-2524

CVE-2005-2524 affects Safari on Apple Mac OS X 10.3.9 where remote attackers can bypass domain restrictions by presenting crafted web archives that cause Safari to render them as if from a different site. The available connected sources confirm the vulnerability description but do not provide con...

Mac OS X Multiple Vulnerabilities (Security Update 2005-008)

The remote host is running Apple Mac OS X, but lacks Security Update 2005-008. This security update contains fixes for the following applications : - ImageIO - LibSystem - Mail - QuickDraw - Ruby - SecurityAgent - securityd C Tenable Network Security, Inc. include"compat.inc"; if description...

CVE-2004-2524

clogin.php in Benchmark Designs' WHM AutoPilot 2.4.5 and earlier allows remote attackers to obtain plaintext username and password credentials by using the clogine and base64encode functions to encode the desired user ID in the c parameter, then read the plaintext values in the resulting form...