Securifi Almond Man-in-the-Middle Attack Vulnerability

Securifi Almond is a wireless router product from Securifi. A man-in-the-middle attack vulnerability exists in Securifi Almond. It allows remote attackers to forge a response by using a linear algorithm to select the ID value in the header when the program executes a DNS query...

Foreman Man-in-the-Middle Attack Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman versions prior to 1.7.4, which stems from the program's failu...

CVE-2015-4534

Java Method Server JMS in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 allows remote authenticated users to execute arbitrary code by forging a signature for a query string that lacks the methodverb parameter...

Cisco ASA uRPF Checksum Bypass Vulnerability

The Cisco Adaptive Security Appliance is an adaptive security appliance that provides modules for security and VPN services. The Cisco Adaptive Security Appliance uRPF has a security vulnerability. Due to failure to properly verify the uRPF of an external interface IP message, if the IP address...

The vulnerability of the microprogramming software of the Cisco TelePresence IP Gateway allows a perpetrator to gain access to the authentication data of arbitrary users.

The vulnerability of the microprogramming software of the Cisco TelePresence IP Gateway device is related to the falsification of inter-site requests. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the authentication data of arbitrary users...

F21 JWT fails to verify token signatures

Overview JWT provided by F21 is a PHP library for handling JSON Web Tokens. php-jwt contains a vulnerability where it fails to verify token signatures. Toshiharu Sugiyama of DeNA Co., Ltd. and Shuntaro Maeda reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

pcs: improper web session variable signing

It was found that the pcs daemon did not sign cookies containing session data that were sent to clients connecting via the pcsd web UI. A remote attacker could use this flaw to forge cookies and bypass authorization checks, possibly gaining elevated privileges in the pcsd web UI...

OpenStack s3_token encryption issue vulnerability

OpenStack Keystone is a collaboration between the National Aeronautics and Space Administration NASA and Rackspace, Inc. to develop a project for authentication that provides identity, token, directory, and policy services.OpenStack keystonemiddleware formerly known as python-keystoneclient is on...

Updated cups-filters packages fix CVE-2015-2265

Updated cups-filters package fixes security vulnerability: cups-browsed in cups-filters before 1.0.66 contained a bug in the removebadchars function, where it failed to reliably filter out illegal characters if there were two or more subsequent illegal characters, allowing execution of arbitrary...

UBUNTU-CVE-2015-0259

OpenStack Compute Nova before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage...

Google could be forged domain mailbox fishing-vulnerability warning-the black bar safety net

! Recently Google Apps for Work exposed a vulnerability that an attacker can use the vulnerability to falsification of any of the site's domain name mailbox, posing as company employees to the victims, sending phishing mail. Google domain mail service 如果 你 想 弄 一 个 类似 [email protected] 的 DIY 邮箱 来 代替...

DSA-3161-1 dbus - security update

Bulletin has no description...

tinyproxy: denial of service

It was discovered that a remote attacker is able to cause a denial of service CPU and memory consumption via 1 a large number of headers or 2 a large number of forged headers that predictably trigger hash collisions...

CVE-2014-6324

The Kerberos Key Distribution Center KDC in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a...

PT-2014-2025

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2003 SP2 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Description The Kerberos Key...

Microsoft Considering Public-Key Pinning for Internet Explorer

Microsoft is considering adding public-key pinning–an important defense against man-in-the-middle attacks–to Internet Explorer. The feature is designed to help protect users against the types of MITM attacks that rely on forged certificates, which comprise a large portion of those attacks...

CVE-2014-7725

The Rally Albania Live 2014 aka com.wRallyAlbaniaLIVE2014 application 0.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7707

The Outdoor Design And Living aka com.pocketmagsau.outdoordesignandliving application @7F080181 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Mozilla Network Security Services RSA Signature Forgery (CVE-2014-1568)

An RSA signature forgery vulnerability exists in Mozilla Network Security Services NSS, the cryptographic library used in many applications including Firefox and Google Chrome. The vulnerability is a result of improper verification of RSA signatures due to incorrect ASN.1 parsing of the DigestInf...

ntopng 1.2.0 - XSS Injection

No description provided by source. ntopng 1.2.0 XSS injection using monitored network traffic ntopng is the next generation version of the original ntop, a network traffic probe and monitor that shows the network usage, similar to what the popular top Unix command does. The web-based frontend of...