USN-1346-1: curl vulnerability

Dan Fandrich discovered that curl incorrectly handled URLs containing embedded or percent-encoded control characters. If a user or automated system were tricked into processing a specially crafted URL, arbitrary data could be injected...

URL sanitization vulnerability

curl is vulnerable to a data injection attack for certain protocols through control characters embedded or percent-encoded in URLs. When parsing URLs, libcurl's parser is liberal and only parses as little as possible and lets as much as possible through as long as it can figure out what to do. In...

CVE-2012-0036

curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the 1 IMAP, 2 POP3, or 3 SMTP protocol...

Ajax File and Image Manager 1.0 Final - Remote Code Execution

Ajax File and Image Manager 1.0 Final - Remote Code Execution -------------------------------------------------------------------------- Ajax File and Image Manager v1.0 Final Remote Code Execution Vulnerability --------------------------------------------------------------------------...

Fedora Update for glpi-data-injection FEDORA-2011-9690

Check for the Version of glpi-data-injection OpenVAS Vulnerability Test Fedora Update for glpi-data-injection FEDORA-2011-9690 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/o...

Fedora Update for glpi-data-injection FEDORA-2011-9690

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

[SECURITY] Fedora 14 Update: glpi-data-injection-2.0.2-1.fc14

Plugin for importing data into GLPI It'll can serve, for example, to : - import machines at the delivery electronic delivery order in CSV - import additional data - import equipment not managed by OCS - transmit from an other tool of asset management...

[SECURITY] Fedora 14 Update: glpi-data-injection-2.0.2-1.fc14

Plugin for importing data into GLPI It'll can serve, for example, to : - import machines at the delivery electronic delivery order in CSV - import additional data - import equipment not managed by OCS - transmit from an other tool of asset management...

perl multiple security vulnerabilities

Data injection and protection bypass in lc, lcfirst, uc, ucfirst functions and CGI module...

Mandriva Update for glpi-data-injection MDVA-2011:015 (glpi-data-injection)

Check for the Version of glpi-data-injection OpenVAS Vulnerability Test Mandriva Update for glpi-data-injection MDVA-2011:015 glpi-data-injection Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...

Mandriva Update for glpi-data-injection MDVA-2011:015 (glpi-data-injection)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Design/Logic Flaw

PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by concatenating an...

CVE-2010-3618

CVE-2010-3618 affects PGP Desktop versions 10.0.x prior to 10.0.3 SP2 and 10.1.0 prior to 10.1.0 SP1. The vulnerability lies in the Decrypt/Verify File via Right-Click workflow for multi-packet OpenPGP messages, enabling a remote attacker to spoof signed data by appending an unsigned/extra messag...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

DSA-2090-1 socat - arbitrary code execution

Bulletin has no description...

TLS protocol vulnerable to Man In The Middle attack – Opera Security Advisories

TLS protocol vulnerable to Man In The Middle attack – Opera Security Advisories OPCOM Team | June 29, 2010 Summary A vulnerability has been discovered in all current versions of the SSL and TLS protocols, that may allow an attacker to inject data and instructions into the HTTPS connection and tri...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...