UBUNTU-CVE-2012-2357

The Multi-Authentication feature in the Central Authentication Service CAS functionality in auth/cas/casform.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network...

CVE-2012-2357

CVE-2012-2357 affects Moodle 2.1.x (before 2.1.6) and 2.2.x (before 2.2.3). The issue is in the Multi-Authentication CAS feature (auth/cas/cas_form.html) that does not use HTTPS, enabling credential sniffing over the network by remote attackers. The root cause is unauthenticated, unencrypted tran...

CVE-2012-2357: Exposure of Sensitive Information to an Unauthorized Actor

The Multi-Authentication feature in the Central Authentication Service CAS functionality in auth/cas/casform.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network...

Fedora 17 : moodle-2.2.3-1.fc17 (2012-8284)

CVE-2012-2353 MSA-12-0024: Hidden information access issue CVE-2012-2354 MSA-12-0025: Personal communication access issue CVE-2012-2355 MSA-12-0026: Quiz capability issue CVE-2012-2356 MSA-12-0027: Question bank capability issues CVE-2012-2357 MSA-12-0028: Insecure authentication issue...

Fedora 16 : moodle-2.0.9-1.fc16 (2012-8325)

CVE-2012-2353 MSA-12-0024: Hidden information access issue CVE-2012-2354 MSA-12-0025: Personal communication access issue CVE-2012-2355 MSA-12-0026: Quiz capability issue CVE-2012-2356 MSA-12-0027: Question bank capability issues CVE-2012-2357 MSA-12-0028: Insecure authentication issue...

[SECURITY] Fedora 17 Update: php-pear-CAS-1.3.0-2.fc17

This package is a PEAR library for using a Central Authentication Service...

Fedora 17 : php-pear-CAS-1.3.0-2.fc17 (2012-3903)

Upstream changelog Changes in version 1.3.0 Bug Fixes : - the saml logout url should be parsed urlencoded 24 dlineate - fix a proxy mode bug introduced in a previous comitt 16 Adam Franco - Fix includepath order so that the phpCAS path takes precedence 13 Adam Franco - fix invalid characters in t...

Fedora Update for php-pear-CAS FEDORA-2012-4077

Check for the Version of php-pear-CAS OpenVAS Vulnerability Test Fedora Update for php-pear-CAS FEDORA-2012-4077 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Fedora Update for php-pear-CAS FEDORA-2012-4077

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for php-pear-CAS FEDORA-2012-4119

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for php-pear-CAS FEDORA-2012-4119

Check for the Version of php-pear-CAS OpenVAS Vulnerability Test Fedora Update for php-pear-CAS FEDORA-2012-4119 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Fedora 16 : php-pear-CAS-1.3.0-2.fc16 (2012-4119)

Upstream changelog Changes in version 1.3.0 Bug Fixes : - the saml logout url should be parsed urlencoded 24 dlineate - fix a proxy mode bug introduced in a previous comitt 16 Adam Franco - Fix includepath order so that the phpCAS path takes precedence 13 Adam Franco - fix invalid characters in t...

[SECURITY] Fedora 16 Update: php-pear-CAS-1.3.0-2.fc16

This package is a PEAR library for using a Central Authentication Service...

Mozilla to Warn CAs About Issuing MITM Certificates

Mozilla officials are preparing to send a letter to the certificate authorities that are part of its root CA program, warning them about issuing so-called man-in-the-middle certificates for systems that the CA does not actually own. The message comes on the heels of an incident in which Trustwave...

Analysis: Duqu Targets Certificate Authorities

With virus researchers scrambling to decode a new piece of malware that is based on the code of the Stuxnet worm, an analyst at McAfee is speculating that the new worm, Duqu, may have been created to target certificate authorities. Writing on McAfee’s research blog, Guilherme Venere and Peter Szo...

Debian DSA-2307-1 : chromium-browser - several vulnerabilities

Several vulnerabilities were discovered in the Chromium browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-2818 Use-after-free vulnerability in Google Chrome allows remote attackers to cause a denial of service or possibly have unspecified oth...

Are Some Certificate Authorities Too Big To Fail?

In the wake of this weekend’s revelations of the seriousness of the attack on certificate authority DigiNotar, security experts have renewed criticism of the Internet’s digital certificate infrastructure, with some wondering if larger certificate authorities CAs might be too big to fail...

Unfixed XSS vulnerability at forum.electronicwerkstatt.de

Security researcher cAs, has submitted on 09/06/2011 a cross-site-scripting XSS vulnerability affecting forum.electronicwerkstatt.de, which at the time of submission ranked 35692 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2011. It is...

How to secure SSL connections and remove DigiNotar certificates from the Trusted CAs list

...

MS11-044: Vulnerability in .NET Framework Could Allow Remote Code Execution (2538814)

The JIT compiler included with the version of the .NET Framework installed on the remote host incorrectly validates certain values within an object. An attacker may be able to leverage this vulnerability to run arbitrary code as the logged in user or the user account of ASP.NET on the affected...