2383 matches found
Fedora 18 : php-pear-CAS-1.3.2-1.fc18 (2012-21084)
Changes in version 1.3.2 Security Fixes : - CVE-2012-5583 Missing CN validation of CAS server certificate 58 Joachim Fritschi Bug Fixes : - Fix broken character encoding in Greek and French 40 Joachim Fritschi - Minor error corrections in a few example files Joachim Fritschi - Remove erroneous...
Fedora 17 : php-pear-CAS-1.3.2-1.fc17 (2012-21106)
Changes in version 1.3.2 Security Fixes : - CVE-2012-5583 Missing CN validation of CAS server certificate 58 Joachim Fritschi Bug Fixes : - Fix broken character encoding in Greek and French 40 Joachim Fritschi - Minor error corrections in a few example files Joachim Fritschi - Remove erroneous...
Fedora 16 : php-pear-CAS-1.3.2-1.fc16 (2012-21122)
Changes in version 1.3.2 Security Fixes : - CVE-2012-5583 Missing CN validation of CAS server certificate 58 Joachim Fritschi Bug Fixes : - Fix broken character encoding in Greek and French 40 Joachim Fritschi - Minor error corrections in a few example files Joachim Fritschi - Remove erroneous...
PHPDrive privilege elevation vulnerability and the Fix-vulnerability warning-the black bar safety net
PHPDrive is set to run in the PHP environment file management system, can be applied to a network disk, enterprise document management, schools, team management, software, file, CMS, etc. includes/user.lib.php Row 8 7 function getip ifisset$SERVER"HTTPXFORWARDEDFOR"&&$SERVER"HTTPXFORWARDEDFOR" $i...
mod_rpaf: Denial of service
Background modrpaf is a reverse proxy add forward module for backend Apache servers. Description An error has been found in the way modrpaf handles X-Forwarded-For headers. Please review the CVE identifier referenced below for details. Impact A remote attacker could send a specially crafted HTTP...
DEBIAN-CVE-2012-3526
The reverse proxy add forward module modrpaf 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service server or application crash via multiple X-Forwarded-For headers in a request...
Cross site request forgery (csrf)
The reverse proxy add forward module modrpaf 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service server or application crash via multiple X-Forwarded-For headers in a request...
CVE-2012-3526
The reverse proxy add forward module modrpaf 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service server or application crash via multiple X-Forwarded-For headers in a request...
CVE-2012-2566
Bloxx Web Filtering before 5.0.14 does not properly interpret X-Forwarded-For headers during access-control and logging operations for HTTPS connection attempts, which allows remote attackers to bypass intended IP address and domain restrictions, and trigger misleading log entries, via a crafted...
Design/Logic Flaw
Bloxx Web Filtering before 5.0.14 does not properly interpret X-Forwarded-For headers during access-control and logging operations for HTTPS connection attempts, which allows remote attackers to bypass intended IP address and domain restrictions, and trigger misleading log entries, via a crafted...
CVE-2012-2566
CVE-2012-2566 concerns Bloxx Web Filtering prior to 5.0.14. The issue is that the product does not correctly interpret the X-Forwarded-For header during HTTPS access-control and logging, which can allow an unauthenticated user to bypass IP/domain restrictions and produce misleading logs. The entr...
Fedora 16 : bugzilla-4.0.6-1.fc16 (2012-6368)
The following security issues have been discovered in Bugzilla : - When abusing the X-FORWARDED-FOR header, an attacker could bypass the lockout policy allowing a possible brute-force discovery of a valid user password. - An attacker can get access to some bug information using the victim's...
Fedora 15 : bugzilla-3.6.9-1.fc15 (2012-6396)
The following security issues have been discovered in Bugzilla : - When abusing the X-FORWARDED-FOR header, an attacker could bypass the lockout policy allowing a possible brute-force discovery of a valid user password. - An attacker can get access to some bug information using the victim's...
CVE-2012-0465
Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inboundproxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series of authentication...
CVE-2012-0465
Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inboundproxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series of authentication...
CVE-2012-0465
CVE-2012-0465 affects Bugzilla versions 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1. Root cause: improper validation of the X-Forwarded-For header when inbound_proxies is enabled, allowing bypass of the lockout policy via repeated authentication re...
Security advisory for Bugzilla 4.2.1, 4.0.6 and 3.6.9
Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: When abusing the X-FORWARDED-FOR header, an attacker could bypass the lockout policy allowing a possible brute-force discovery o...
Debian DSA-2332-1 : python-django - several issues
Paul McMillan, Mozilla and the Django core team discovered several vulnerabilities in Django, a Python web framework : - CVE-2011-4136 When using memory-based sessions and caching, Django sessions are stored directly in the root namespace of the cache. When user data is stored in the same cache, ...