CVE-2012-4523

radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients...

Debian DSA-2573-1 : radsecproxy - SSL certificate verification weakness

Ralf Paffrath reported that Radsecproxy, a RADIUS protocol proxy, mixed up pre- and post-handshake verification of clients. This vulnerability may wrongly accept clients without checking their certificate chain under certain configurations. Raphael Geissert spotted that the fix for CVE-2012-4523...

DSA-2573-1 radsecproxy - SSL certificate verification weakness

Bulletin has no description...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 index.php, 2 modules/admin/adminmoduleindex.php, or 3 modules/calendar/customisecalendartimes.php; login parameter to 4 index.ph...

CVE-2011-5214

CVE-2011-5214 concerns multiple cross-site scripting (XSS) vulnerabilities in BrowserCRM, affecting version 5.100.01 and earlier. The issue allows remote attackers to inject arbitrary script or HTML via: (1) PATH_INFO to index.php, (2) modules/admin/admin_module_index.php, (3) modules/calendar/cu...

[SECURITY] Fedora 16 Update: phpldapadmin-1.2.2-3.gitbbedf1.fc16

PhpLDAPadmin is a web-based LDAP client. It provides easy, anywhere-accessible, multi-language administration for your LDAP server. Its hierarchical tree-viewer and advanced search functionality make it intuitive to browse and administer your LDAP director y. Since it is a web application, this...

PwnedList Partnership Provides Credential Monitoring for LastPass Users

A partnership announced today merges LastPass’s credential management services with PwnedList’s credential monitoring services. The companies said “credential management and credential monitoring are natural complements” and that the move will bolster password security for LastPass end users...

Cisco IOS Aironet Access Point DoS

The remote Cisco IOS device may have a denial of service vulnerability. An input queue wedge can occur when IOS is running on an Aironet Access Point. This results in clients being unable to be authenticated, resulting in a denial of service. C Tenable Network Security, Inc. include"compat.inc"; ...

Mandriva Update for busybox MDVSA-2012:129-1 (busybox)

Check for the Version of busybox OpenVAS Vulnerability Test Mandriva Update for busybox MDVSA-2012:129-1 busybox Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Mandriva Update for busybox MDVSA-2012:129-1 (busybox)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CVE-2011-5098

chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the...

CVE-2011-5098

chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the...

CVE-2011-5098

chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the...

Scientific Linux Security Update : squid on SL6.x i386/x86_64

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. It was found that string comparison functions in Squid did not properly handle the comparisons of NULL and empty strings. A remote, trusted web client could use this flaw to cause the...

Scientific Linux Security Update : device-mapper-multipath on SL4.x, SL5.x i386/x86_64

It was discovered that the multipathd daemon set incorrect permissions on the socket used to communicate with command line clients. An unprivileged, local user could use this flaw to send commands to multipathd, resulting in access disruptions to storage devices accessible via multiple paths and,...

CentOS Update for krb5-appl-clients CESA-2011:1852 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for krb5-appl-clients CESA-2011:1852 centos6

Check for the Version of krb5-appl-clients OpenVAS Vulnerability Test CentOS Update for krb5-appl-clients CESA-2011:1852 centos6 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it...

Debian DSA-2511-1 : puppet - several vulnerabilities

Several security vulnerabilities have been found in Puppet, a centralized configuration management : - CVE-2012-3864 Authenticated clients could read arbitrary files on the puppet master. - CVE-2012-3865 Authenticated clients could delete arbitrary files on the puppet master. - CVE-2012-3866 The...

CVE-2012-3376

DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and...

Design/Logic Flaw

DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and...