DEBIAN-CVE-2015-8125

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the 1 Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or 2...

UBUNTU-CVE-2015-8125

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the 1 Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or 2...

squid security and bug fix update

7:3.3.8-26 - Related: 1186768 - removing patch, because of missing tests and incorrent patch 7:3.3.8-25 - Related: 1102842 - squid rpm package misses /var/run/squid needed for smp mode. Squid needs write access to /var/run/squid. 7:3.3.8-24 - Related: 1102842 - squid rpm package misses...

CVE-2014-9749

Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."...

CVE-2014-9749

Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."...

CVE-2005-0373

Buffer overflow in digestmd5.c CVS release 1.170 also referred to as digestmda5.c, as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code...

Gentoo Security Advisory GLSA 201401-33

Gentoo Linux Local Security Checks GLSA 201401-33 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

freeradius security, bug fix, and enhancement update

2.2.6-4 - Move OpenSSL init out of version check Resolves: Bug1189394 radiusd segfaults after update - Comment-out ippool-dhcp.conf inclusion Resolves: Bug1189386 radiusd fails to start after 'clean' installation 2.2.6-3 - Disable OpenSSL version check Resolves: Bug1189011 2.2.6-2 - Fix a number ...

Open Smart Grid Protocol Homegrown Crypto Weaknesses

In the three years since its inception, the Open Smart Grid Protocol has found its way into more than four million smart meters and similar devices worldwide. And like its SCADA, industrial control system, and embedded system brethren, it’s rife with security issues. Two researchers, Phillip...

NTP 'ntp-keygen.c' Predictive Random Number Vulnerability

NTP Network Time Protocol is a protocol used by clients to synchronize the date and time with a time server. A security vulnerability in NTP 'ntp-keygen.c' allows attackers to take control of the server by guessing the MD5 generated key...

McAfee Email Gateway Cross-Site Scripting Vulnerability

McAfee Email Gateway MEG is a suite of email security solutions from the U.S.-based company McAfee McAfee. The program provides incoming threat protection, outgoing encryption, data loss protection and other features. A cross-site scripting vulnerability exists in McAfee Email Gateway. A remote...

CVE-2015-1619

Cross-site scripting XSS vulnerability in the Secure Web Mail Client user interface in McAfee Email Gateway MEG 7.6.x before 7.6.3.2, 7.5.x before 75.6, 7.0.x through 7.0.5, 5.6, and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified tokens in Digest...

Cross site scripting

Cross-site scripting XSS vulnerability in the Secure Web Mail Client user interface in McAfee Email Gateway MEG 7.6.x before 7.6.3.2, 7.5.x before 75.6, 7.0.x through 7.0.5, 5.6, and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified tokens in Digest...

subversion: credentials leak via MD5 collision

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the...

RHEL 5 / 6 : tomcat5 (RHSA-2012:0680)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0680 advisory. - tomcat: Multiple weaknesses in HTTP DIGEST authentication CVE-2011-1184, CVE-2011-5062, CVE-2011-5063, CVE-2011-5064 - tomcat: passwor...

RHEL 5 / 6 : tomcat6 (RHSA-2012:0682)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0682 advisory. - tomcat: Multiple weaknesses in HTTP DIGEST authentication CVE-2011-1184, CVE-2011-5062, CVE-2011-5063, CVE-2011-5064 - tomcat: passwor...

CVE-2014-4890

The Nano Digest aka com.magzter.nanodigest application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Nano Digest aka com.magzter.nanodigest application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-4890

CVE-2014-4890 affects the Android app Nano Digest (com.magzter.nanodigest) v3.0. The root cause is failure to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive data via a crafted certificate. Public sources (NVD and related reco...

CVE-2014-4890

The Nano Digest aka com.magzter.nanodigest application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...