3526 matches found
Amazon Linux AMI : httpd24 (ALAS-2015-483)
modlua.c in the modlua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access...
OracleVM 2.2 : glibc (OVMSA-2015-0024) (GHOST)
The remote OracleVM system is missing necessary patches to address critical security updates : - Switch to use malloc when the input line is too long Orabug 19951108 - Use a /sys/devices/system/cpu/online for SCNPROCESSORSONLN implementation Orabug 17642251 Joe Jin - Fix parsing of numeric hosts ...
glibc, nscd security update
CentOS Errata and Security Advisory CESA-2015:0092 Updated glibc packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base score,...
Google Chrome SSL Certificate Validation Vulnerability
Google Chrome is a popular WEB browser. A certificate validation vulnerability exists in Google Chrome SSL that allows attackers to conduct AppCache caching of SSL sessions to spoof HTML5 application content...
Apache Traffic Server Unsupported
According to its banner, the version of Apache Traffic Server running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. C Tenable Network...
Microsoft Windows NtApphelpCacheControl Improper Authorization Check
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' class Metasploit3 'Microsoft Windows NtApphelpCacheControl Improper Authorization Check',...
CURL-CVE-2014-8151 Secure Transport certificate check bypass
libcurl stores TLS Session IDs in its associated Session ID cache when it connects to TLS servers. In subsequent connects it reuses the entry in the cache to resume the TLS connection faster than when doing a full TLS handshake. The actual implementation for the Session ID caching varies dependin...
glibc, nscd security update
CentOS Errata and Security Advisory CESA-2015:0016 Updated glibc packages that fix two security issues and two bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base...
openSUSE Security Update : subversion (openSUSE-SU-2014:1725-1)
This Apache Subversion update fixes the following security and non security issues. - Apache Subversion 1.8.11 - This release addresses two security issues: boo909935 - CVE-2014-3580: moddavsvn DoS from invalid REPORT requests. - CVE-2014-8108: moddavsvn DoS from use of invalid transaction names....
ThinkOX full version through the kill 0day-vulnerability warning-the black bar safety net
Affected versions: ThinkOX the full version of the pass to killonethink and thinkphp framework may be affected, particularly too lazy to do it, who are interested in your own analysis. Vulnerability description: Through a dynamic caching mechanism, the input illegal content. Malicious execution o...
Debian Security Advisory DSA 3097-1 (unbound - security update)
Florian Maury from ANSSI discovered that unbound, a validating, recursive, and caching DNS resolver, was prone to a denial of service vulnerability. An attacker crafting a malicious zone and able to emit or make emit queries to the server can trick the resolver into following an endless series of...
httpd: NULL pointer dereference in mod_cache if Content-Type has empty value
A NULL pointer dereference flaw was found in the way the modcache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled...
The offline cookbook
Update: Together with Udacity I created a free offline-first interactive course. It involves taking an online-only site to full offline-first glory. Many of the patterns in this article are used. When AppCache arrived on the scene it gave us a couple of patterns to make content work offline. If...
powerdns-recursor: denial of service
PowerDNS, while acting as a caching nameserver, can be negatively impacted by sending queries for specially configured, hard to resolve domain names. This is the same issue as the ones found in bind ASA-201412-7 and unbound ASA-201412-8...
RHEL 5 : gc in Satellite Server (RHSA-2014:0150)
Updated gc packages that fix one security issue are now available for Red Hat Satellite Proxy 5.6. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...
[SECURITY] Fedora 20 Update: squid-3.3.13-2.fc20
Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DN...
[SECURITY] Fedora 19 Update: squid-3.3.13-2.fc19
Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DN...
[SECURITY] Fedora 21 Update: squid-3.4.7-2.fc21
Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DN...
