CVE-2014-3604

Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2014-3604

Removed by vendor...

Oracle Identity Manager (October 2014 CPU

The remote host is missing the October 2014 Critical Patch Update for Oracle Identity Manager. It is, therefore, affected by multiple vulnerabilities : - The application is affected by a vulnerability in Apache Commons BeanUtils in which ClassLoader objects can be set via the class attribute of a...

[ MDVSA-2014:170 ] jakarta-commons-httpclient

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:170 http://www.mandriva.com/en/support/security/ Package : jakarta-commons-httpclient Date : September 2, 2014 Affected: Business Server 1.0 Problem Description: Updated jakarta-commons-httpclient and...

serf / Apache httpcomponents HttpClient / Jakarta Commons HttpClient SSL validation bypass

Invalid parsing of certificates with NUL character in CN...

CVE-2014-8747

Cross-site scripting XSS vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages...

Cross site scripting

Cross-site scripting XSS vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages...

CVE-2014-8747

CVE-2014-8747 is a cross-site scripting (XSS) vulnerability in Drupal Commons 7.x-3.x (prior to 7.x-3.9) for Drupal. The issue affects messages in the activity stream related to content creation, where unsanitized content could allow injection of arbitrary scripts/HTML. Root cause: inadequate san...

CVE-2014-8747

Cross-site scripting XSS vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages...

PT-2014-8706

Name of the Vulnerable Software and Affected Versions Drupal Commons module versions 7.x-3.x before 7.x-3.9 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages...

CVE-2014-8747: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages...

Amazon Linux AMI : jakarta-commons-httpclient (ALAS-2014-410)

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle...

Amazon Linux AMI : tomcat6 (ALAS-2014-344)

It was found that when Tomcat processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat would incorrectly handle the request. A remote attacker could use this fla...

F5 Networks BIG-IP : Apache Commons FileUpload vulnerability (K15189)

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service infinite loop and CPU consumption via a crafted Content-Type header that bypasses a loop's intended exit conditions...

Fedora Update for not-yet-commons-ssl FEDORA-2014-10746

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for not-yet-commons-ssl FEDORA-2014-10729

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 20 : not-yet-commons-ssl-0.3.15-2.fc20 (2014-10729)

Fix jar path in install. Update to upstream 0.3.15. Fixes CVE-2014-3604 . Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 19 : not-yet-commons-ssl-0.3.15-2.fc19 (2014-10746)

Fix jar path in install. Update to upstream 0.3.15. Fixes CVE-2014-3604 . Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[SECURITY] Fedora 19 Update: not-yet-commons-ssl-0.3.15-2.fc19

Commons-SSL lets you control the SSL options you need in an natural way for each SSLSocketFactory, and those options won't bleed into the rest of your system...

[SECURITY] Fedora 20 Update: not-yet-commons-ssl-0.3.15-2.fc20

Commons-SSL lets you control the SSL options you need in an natural way for each SSLSocketFactory, and those options won't bleed into the rest of your system...