CVE-2015-0253

CVE-2015-0253 affects the Apache HTTP Server 2.4.12. The vulnerability arises in the read_request_line function within server/protocol.c, where the protocol structure member is not initialized. This can enable a remote attacker to trigger a denial-of-service via a NULL pointer dereference and cra...

CVE-2015-0253

The readrequestline function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service NULL pointer dereference and process crash by sending a request that lacks a method to an installation...

Apache ErrorDocument 400 Points to Denial of Service Vulnerability

Apache is an open source HTTPD service program. A security vulnerability exists in Apache that allows a remote user to crash an application via ErrorDocument 400 pointing to a local URL path containing an active INCLUDES filter, resulting in a denial-of-service attack...

JVN#34790526: checkpw vulnerable to denial-of-service (DoS)

checkpw is a password authentication program. checkpw contains a denial-of-service DoS vulnerability due to a flaw in processing account names CWE-400. Impact A remote attacker may be able to cause a denial-of-service DoS. Solution Update the Software Update to the latest version according to the...

apache24 -- multiple vulnerabilities

Jim Jagielski reports: CVE-2015-3183 cve.mitre.org core: Fix chunk header parsing defect. Remove aprbrigadeflatten, buffering and duplicated code from the HTTPIN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized...

openSUSE Security Update : phpMyAdmin (openSUSE-SU-2014:1636-1)

phpMyAdmin on openSUSE 12.3 and 13.1 was updated to 4.1.14.8. This update fixes one vulnerability. - Security fixes : - PMASA-2014-17 CVE-2014-9218, CWE-661 CWE-400 boo908363 http://www.phpmyadmin.net/homepage/security/PMASA-2014- 17.php - sf4611 security DOS attack with long passwords phpMyAdmin...

[The ManageOwnage Series, part VI]: 0day database info and superuser credential disclosure in EventLog Analyser

Hi, This is the 6th part of the ManageOwnage series. For previous parts see 1. This time we have two 0 day vulns CVE-2014-6038 and 6039 that can be abused to dump information from the database and obtain the superuser credentials for Windows and AS/400 hosts which are managed by EventLog Analyzer...

ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure

ManageEngine Eventlog Analyzer from v7 to v9.9 b9002 has two security vulnerabilities that allow an unauthenticated user to obtain the superuser password of any managed Windows and AS/400 hosts. This module abuses both vulnerabilities to collect all the available usernames and passwords. First th...

ManageEngine EventLog Analyzer SQL / Credential Disclosure

Hi, This is the 6th part of the ManageOwnage series. For previous parts see 1. This time we have two 0 day vulns CVE-2014-6038 and 6039 that can be abused to dump information from the database and obtain the superuser credentials for Windows and AS/400 hosts which are managed by EventLog Analyzer...

ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure

ManageEngine Eventlog Analyzer from v7 to v9.9 b9002 has two security vulnerabilities that allow an unauthenticated user to obtain the superuser password of any managed Windows and AS/400 hosts. This module abuses both vulnerabilities to collect all the available usernames and passwords. First th...

ManageEngine EventLog Analyzer - Multiple Vulnerabilities (2)

ManageEngine EventLog Analyzer - Multiple Vulnerabilities 2 Multiple vulnerabilities in ManageEngine EventLog Analyzer Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 05/11/2014 / Last...

ManageEngine EventLog Analyzer - Multiple Vulnerabilities (2)

Multiple vulnerabilities in ManageEngine EventLog Analyzer Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 05/11/2014 / Last updated: 05/11/2014 Background on the affected product:...

Internet Bug Bounty: open redirect in rfc6749

OAuth Providers servers that strictly follow rfc6749 are vulnerable to open redirect. Let me explain, reading 0 If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource...

CVE-2014-5266

CVE-2014-5266 affects Drupal Core XML-RPC Endpoint xmlrpc.php. The DoS arises from how XML-RPC requests are processed, leading to very high CPU load and memory exhaustion. Affected: Drupal 6.x prior to 6.33 and Drupal 7.x prior to 7.31. Exploitation requires no authentication and is remote. Remed...

Siemens Simatic S7-300/400 CPU START/STOP Module

No description provided by source...

OS/400 User Account Name Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4059/info AS/400 is a midrange computer platform developed by IBM. It is designed to be highly reliable and efficient, and uses the OS/400 operating system. An information disclosure vulnerability has been reported to exi...

Fortinet FortiMail 400 IBE Multiple Vulnerabilities

No description provided by source...

CVE-2014-3243

SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted SOAP request containing a large number of nested entity references...

[CVE-2013-4484] DoS vulnerability in Varnish HTTP cache

Summary ======= Varnish Cache with certain configurations is vulnerable to a denial of service attack. Three lines of VCL code solves the problem. This issue was discovered by Ilia Sharov, Yandex. This has been assigned CVE-2013-4484. Details ======= If Varnish receives a certain illegal request,...

Fortinet FortiMail 400 IBE - Multiple Web Vulnerabilities

Document Title: =============== Fortinet FortiMail 400 IBE - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=701 www.fortiguard.com/advisory/FG-IR-013-001.html Video: http://www.youtube.com/watch?v=5d7cIaM80oY Release Date:...