CVE-2014-3505

OpenSSL CVE-2014-3505 is a remote DoS vulnerability in the DTLS implementation (d1_both.c) that can crash the application via crafted DTLS packets. Affected OpenSSL versions are 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i; the issue stems from a double free during DTLS mess...

openssl security update

CentOS Errata and Security Advisory CESA-2014:1053 Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

Moderate: Red Hat Security Advisory: openssl security update

Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available...

Fedora 20 : openssl-1.0.1e-39.fc20 (2014-9308) (Heartbleed)

Multiple moderate issues fixed. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : openssl (MDVSA-2014:158)

Multiple vulnerabilities has been discovered and corrected in openssl : A flaw in OBJobj2txt may cause pretty printing functions such as X509nameoneline, X509nameprintex et al. to leak some information from the stack. Applications may be affected if they echo pretty printing output to the attacke...

OpenSSL 1.0.0 < 1.0.0n Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.0n. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.0n advisory. - The ssl3sendclientkeyexchange function in s3clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i...

[DLA 33-1] openssl security update

Package : openssl Version : 0.9.8o-4squeeze17 CVE ID : CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 CVE-2014-3510 Detailed descriptions of the vulnerabilities can be found at: https://www.openssl.org/news/secadv20140806.txt Its important that you upgrade the libssl0.9.8 package and not...

[SECURITY] [DSA 2998-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2998-1 [email protected] http://www.debian.org/security/ Raphael Geissert August 07, 2014 http://www.debian.org/security/faq -...

CVE-2013-3505

The CVE-2013-3505 issue affects the Nagios-App component in GroundWork Monitor Enterprise 6.7.0. Affected behavior: remote authenticated users can bypass intended access restrictions by directly requesting either a log file or a configuration file. Root cause stated in sources: improper access co...

Debian Security Advisory DSA 2564-1 (tinyproxy)

The remote host is missing an update to tinyproxy announced via advisory DSA 2564-1. OpenVAS Vulnerability Test $Id: deb25641.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2564-1 tinyproxy Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

[SECURITY] [DSA 2564-1] tinyproxy security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2564-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst October 23, 2012 http://www.debian.org/security/faq -...

Debian DSA-2564-1 : tinyproxy - denial of service

gpernot discovered that Tinyproxy, a HTTP proxy, is vulnerable to a denial of service by remote attackers by sending crafted request headers. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

CVE-2012-3505

Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service CPU and memory consumption via 1 a large number of headers or 2 a large number of forged headers that trigger hash collisions predictably. bucket...

Code injection

Unspecified vulnerability in the Agile Core component in Oracle Supply Chain Products Suite 9.3.0.2 and 9.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Web Client, a different vulnerability than CVE-2010-3505...

CVE-2010-3505

CVE-2010-3505 describes an unspecified vulnerability in the Agile Core component of Oracle Supply Chain Products Suite 9.3.0.2 and 9.3.1. The issue would allow remote authenticated users to affect confidentiality via unknown vectors related to Folders, Files & Attachments (a different vulnerabili...

CVE-2009-3505

The CVE-2009-3505 entry documents a SQL injection vulnerability in view_news.php of the Vastal I-Tech MMORPG Zone, exploitable via the news_id parameter. The underlying issue is improper handling of user-supplied input in a SQL query, enabling remote attackers to execute arbitrary SQL commands. T...

CVE-2008-3505

PolyPager 1.0 rc2 and earlier is affected by a Cross‑site Scripting (XSS) vulnerability. The issue arises in the default URI where an attacker can inject arbitrary web script or HTML through the nr parameter. This is documented in CVE-2008-3505/ NVD as an XSS with a base score of 4.3 (Medium) and...

CVE-2008-3505

creationtimestamp| type| source ---|---|--- 2008-06-26 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/5941...

CVE-2007-3505

CVE-2007-3505 involves multiple directory traversal flaws in QuickTalk forum 1.3 that allow remote attackers to include and execute arbitrary local files via a .. sequence in the lang parameter of qtf_checkname.php, qtf_j_birth.php, or qtf_j_exists.php. The affected component is the QuickTalk for...

CVE-2006-3505

CVE-2006-3505 affects WebKit in Apple Mac OS X 10.3.9 and 10.4.7, where a crafted HTML document can cause WebKit to access an object that has already been deallocated, leading to a crash and possible arbitrary code execution. The vulnerability is tied to memory handling of previously released obj...