CVE-2012-3398

Algorithmic complexity vulnerability in Moodle 1.9.x before 1.9.19, 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to cause a denial of service CPU consumption by using the advanced-search feature on a database activity that has many records...

CVE-2012-2098

Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream BZip2CompressorOutputStream in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service CPU consumption via a file with many repeating inputs...

CVE-2012-2098

CVE-2012-2098 affects Apache Commons Compress (BZip2CompressorOutputStream). The vulnerability is an algorithmic complexity in the sorting routines used by the bzip2 stream, allowing an attacker to cause CPU exhaustion (DoS) by feeding input with many repeating patterns. Affected product: Apache ...

CVE-2012-2098

Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream BZip2CompressorOutputStream in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service CPU consumption via a file with many repeating inputs...

CVE-2012-3287

Poul-Henning Kamp md5crypt has insufficient algorithmic complexity and a consequently short runtime, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack, as demonstrated by an attack using GPU hardware...

CVE-2012-3287

Poul-Henning Kamp md5crypt has insufficient algorithmic complexity and a consequently short runtime, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack, as demonstrated by an attack using GPU hardware...

Design/Logic Flaw

Poul-Henning Kamp md5crypt has insufficient algorithmic complexity and a consequently short runtime, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack, as demonstrated by an attack using GPU hardware...

CVE-2012-3287

The CVE concerns Poul-Henning Kamp’s md5crypt, where the md5crypt algorithm has insufficient complexity and short runtime. This enables context-dependent attackers to recover cleartext passwords via brute-force attacks, including GPU-based approaches, as described in the NVD entry and corroborate...

CVE-2012-3287

Poul-Henning Kamp md5crypt has insufficient algorithmic complexity and a consequently short runtime, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack, as demonstrated by an attack using GPU hardware...

PT-2012-4623 · Poul Henning Kamp · Md5Crypt

Name of the Vulnerable Software and Affected Versions: Poul-Henning Kamp md5crypt affected versions not specified Description: The issue concerns the md5crypt algorithm having insufficient complexity and a short runtime, making it easier for attackers to discover cleartext passwords via brute-for...

Fedora 15 : expat-2.1.0-1.fc15 (2012-6996)

This update includes expat 2.1.0, which fixes includes a fix for a security issue. A specially crafted set of keys could trigger hash function collisions, which degrade dictionary performance by changing hash table operations complexity from an expected/average O1 to the worst case On. Reporters...

Fedora 16 : expat-2.1.0-1.fc16 (2012-5058)

This update includes expat 2.1.0, which fixes includes a fix for a security issue. A specially crafted set of keys could trigger hash function collisions, which degrade dictionary performance by changing hash table operations complexity from an expected/average O1 to the worst case On. Reporters...

Hillstone Software HS TFTP Server 1.3.2 - Denial of Service

Hillstone Software HS TFTP Server 1.3.2 - Denial of Service Title : Hillstone Software HS TFTP Server Denial Of Service Vulnerability Author : Prabhu S Angadi from SecPod Technologies www.secpod.com Vendor : http://www.hillstone-software.com/hstftpdetails.htm Advisory :...

GoAhead Webserver 2.5 Cross Site Scripting

Title : GoAhead WebServer Multiple Cross Site Scripting Vulnerabilities Author : Prabhu S Angadi from SecPod Technologies www.secpod.com Vendor : http://www.goahead.com/products/webserver/default.aspx Advisory : http://secpod.org/blog/?p=421 http://secunia.com/advisories/46896...

Spring Source OXM Remote OS Command Injection when XStream and IBM JRE are used

Reference: http://static.springsource.org/spring/docs/3.0.x/spring-framework-reference/html/oxm.htmld0e26722 Product: Spring Source OXM Object/XML Mapping Vendor: VMware Vulnerable Version: 3.0.4 only when XStream and IBM JRE are used Status: Fixed Vendor Notification: 12 October 2010 Vendor Fix:...

Spring Source OXM 3.0.4 Command Injection

Reference: http://static.springsource.org/spring/docs/3.0.x/spring-framework-reference/html/oxm.htmld0e26722 Product: Spring Source OXM Object/XML Mapping Vendor: VMware Vulnerable Version: 3.0.4 only when XStream and IBM JRE are used Status: Fixed Vendor Notification: 12 October 2010 Vendor Fix:...

AT-TFTP Server Remote Denial of Service Vulnerability

AT-TFTP Server v1.8 Remote Denial of Service Vulnerability SecPod Technologies www.secpod.com Author: Antu Sanadi SecPod ID: 1013 01/04/2011 Issue Discovered 04/04/2011 Vendor Notified No Response from the Vendor 25/04/2011 Advisory Released Class: Denial of Service Severity: High Overview:...

Vsftpd 2.3.2 Denial Of Service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 vsftpd 2.3.2 remote denial-of-service Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.net/ Date: - - Dis.: 23.12.2010 - - Pub.: 01.03.2011 CVE: CVE-2011-0762 CERT: VU590604 Fix: vsftpd 2.3.4 15.02.2011 Affected Software verified...

SuSE 10 Security Update : ruby (ZYPP Patch Number 6338)

This ruby update improves return value checks for openssl function OCSPbasicverify CVE-2009-0642 which allowed an attacker to use revoked certificates. The entropy of DNS identifiers was increased CVE-2008-3905 to avaid spoofing attacks. The code for parsing XML data was vulnerable to a denial of...

Digital Affluence Is Making Us Less Secure

Our digital affluence is making us insecure, writes Dan Geer, the CISO at In-Q-Tel. Like addled consumers trying to choose from among 20 different types of toothpaste in the supermarket aisle, IT is paralyzed by an overabundance of security products, unable to decide which products are worth the...