[USN-1677-1] Linux kernel vulnerability

========================================================================== Ubuntu Security Notice USN-1677-1 December 20, 2012 linux vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

UBUNTU-CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

CVE-2012-6426

CVE-2012-6426 affects LemonLDAP::NG prior to 1.2.3. The issue is that it does not use the Lasso library’s signature-verification capability, enabling remote attackers to bypass access-control restrictions through crafted SAML data. The description in connected records confirms the root cause and ...

CVE-2012-6084

Summary (CVE-2012-6084) A denial-of-service vulnerability affects ircd-ratbox and Charybdis IRC daemons due to improper handling of capability negotiation in the CAPAB m_capab.c module. The issue can be triggered remotely by a malformed handshake/request, leading to a NULL pointer dereference and...

CVE-2012-6459

Technical details for CVE-2012-6459 are not publicly available in the provided documents; sources repeat the same vulnerability description without specifics. Monitor for updates.

CVE-2012-4970

Cross-site scripting XSS vulnerability in the web management interface on Polycom HDX Video End Points with UC APL software before 2.7.1.1J, and commercial software before 3.0.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5573

The CVE-2012-5573 issue affects Tor before 0.2.3.25, where SENDME cell handling could trigger memory exhaustion or excessive cell reception, enabling DoS or flow-control bypass. Affected component: core Tor relay/OR handling. Impact per sources: potential Denial of Service on entry nodes. Remedia...

CVE-2012-4970

Cross-site scripting XSS vulnerability in the web management interface on Polycom HDX Video End Points with UC APL software before 2.7.1.1J, and commercial software before 3.0.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

e107 1.0.1 Administrator Cross Site Request Forgery

Exploit Title: e107 v1.0.1 Administrator CSRF Resulting in Arbitrary Javascript Execution Google Dork: intext:"This site is powered by e107" Date: 01/01/13 Exploit Author: Joshua Reynolds Vendor Homepage: http://e107.org Software Link:...

CVE-2012-6371

The WPA2 implementation on the Belkin N900 F9K1104v1 router establishes a WPS PIN based on 6 digits of the LAN/WLAN MAC address, which makes it easier for remote attackers to obtain access to a Wi-Fi network by reading broadcast packets, a different vulnerability than CVE-2012-4366...

CVE-2012-6371

CVE-2012-6371 affects Belkin wireless routers (notably N900 F9K1104v1; also related models listed in the sources) where the WPA2/WPS PIN and default WPA2-PSK passphrase are predictably derived from device MAC addresses. The underlying issue is a WPS PIN generation scheme based on 6 digits of the ...

CVE-2012-6453

Cross-site scripting XSS vulnerability in the RSS Reader extension before 0.2.6 for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a crafted feed...

CVE-2012-5642

server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to trigger unsafe behavior in a custom action file via unspecified symbols in this content...

CVE-2012-6453

Cross-site scripting XSS vulnerability in the RSS Reader extension before 0.2.6 for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a crafted feed...

CVE-2012-6334

The Track My Mobile feature in the SamsungDive subsystem for Android on Samsung Galaxy devices does not properly implement Location APIs, which allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer."...

CVE-2012-6337

The CVE-2012-6337 entry concerns the SamsungDive subsystem’s Track My Mobile feature on Samsung Galaxy devices (Android). The vulnerability relates to the activation of remote tracking, which could allow physically proximate attackers to defeat product-recovery efforts by tampering with the featu...

CVE-2012-6336

The CVE-2012-6336 issue concerns Lookout’s Missing Device feature, where physically proximate attackers can feed arbitrary location data using a simple GPS location spoofer. The NVD entry characterizes the impact as partial integrity and no confidentiality/availability impact, with exploitation p...

CVE-2012-4688 I-GEN opLYNX Central Authentication Bypass

The Central application in i-GEN opLYNX before 2.01.9 allows remote attackers to bypass authentication via vectors involving the disabling of browser JavaScript support...

CVE-2012-4688

CVE-2012-4688 affects i-GEN opLYNX Central software prior to version 2.01.9. The vulnerability is an authentication bypass in the Central application that can be triggered by the attacker bypassing JavaScript in the browser, enabling remote access to configuration settings and possibly other info...