CVE-2014-8472

CA Cloud Service Management CSM before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in CA Cloud Service Management CSM before Summer 2014 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Xxe

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference...

CVE-2014-8472

CA Cloud Service Management CSM before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2014-8472

CVE-2014-8472 affects CA Cloud Service Management prior to the Summer 2014 upgrade, where authentication tokens from an Identity Provider were not properly verified. This allowed a user-assisted remote attacker to bypass access restrictions via unspecified vectors. The issue was addressed in the ...

CVE-2014-8473

CVE-2014-8473 describes a cross-site request forgery vulnerability in CA Cloud Service Management (CSM) prior to the Summer 2014 upgrade. The flaw could allow remote attackers to hijack user sessions via unspecified vectors. The Security Notice (CA Technologies) states this issue was fixed in the...

CVE-2014-8471

CVE-2014-8471 affects CA Cloud Service Management (CSM) prior to the Summer 2014 upgrade, where replay attacks were possible via unspecified vectors. The Security Notice confirms four related vulnerabilities and states they were fixed in the Cloud Service Management Summer 2014 Upgrade, addressin...

CVE-2014-8474

CA Cloud Service Management (CSM) prior to the Summer 2014 upgrade is affected by CVE-2014-8474, an XML External Entity (XXE) vulnerability. An attacker could exploit an XML document containing an external entity declaration and an entity reference to read arbitrary files, launch requests to intr...

CVE-2014-8471

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to conduct replay attacks via unspecified vectors...

CVE-2014-8473: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in CA Cloud Service Management CSM before Summer 2014 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-8474: Undefined Security Weakness

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference...

CVE-2014-8471: Undefined Security Weakness

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to conduct replay attacks via unspecified vectors...

CVE-2014-8472: Improper Authentication

CA Cloud Service Management CSM before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors...

CA Antivirus Engine 8.1.637 CAB 缓冲区溢出漏洞

No description provided by source...

Debian Security Advisory DSA 3055-1 (pidgin - security update)

Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client: CVE-2014-3694 It was discovered that the SSL/TLS plugins failed to validate the basic constraints extension in intermediate CA certificates. CVE-2014-3695 Yves Younan and Richard Johnson discovered...

CA20141001-01: Security Notice for Bash Shellshock Vulnerability

CA20141001-01: Security Notice for Bash Shellshock Vulnerability Issued: October 01, 2014 Updated: October 03, 2014 CA Technologies is investigating multiple GNU Bash vulnerabilities, referred to as the "Shellshock" vulnerabilities, which were publicly disclosed on September 24-27, 2014. CVE...

Amazon Linux AMI : ca-certificates (ALAS-2011-3)

This package contains the set of CA certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure PKI. It was found that a Certificate Authority CA issued fraudulent HTTPS certificates. This update removes that CA's root certificate from the ca-certificates...

CentOS 5 : nss (CESA-2014:1246)

Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

Debian DSA-3037-1 : icedove - security update

Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS the Mozilla Network Security Service library, embedded in Wheezy's Icedove, was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. An attacker could craft ASN.1 data to forge RSA...

Debian DSA-3033-1 : nss - security update

Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS the Mozilla Network Security Service library was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. An attacker could craft ASN.1 data to forge RSA certificates with a valid certification...