IBM WebSphere Application Server 7.0 < Fix Pack 33 Multiple Vulnerabilities

IBM WebSphere Application Server 7.0 prior to Fix Pack 33 is running on the remote host. It is, therefore, affected by the following vulnerabilities : - A cross-site scripting flaw exists within the Administration Console, where user input is improperly validated. This could allow a remote...

VMware Horizon View Client < 3.0.0 Multiple SSL Vulnerabilities (VMSA-2014-0006) (Mac OS X)

The version of VMware Horizon View Client installed on the remote Mac OS X host is a version prior to 3.0.0. It is, therefore, affected by multiple vulnerabilities in the bundled OpenSSL library : - An error exists in the function 'ssl3readbytes' that could allow data to be injected into other...

OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069)

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle ha...

HP Smart Update Manager 6.x < 6.4.1 Multiple Vulnerabilities

The version of HP Smart Update manager running on the remote host is prior to 6.4.1. It is, therefore, affected by the following vulnerabilities : - An error exists in the function 'ssl3readbytes' that can allow data to be injected into other sessions or allow denial of service attacks. Note that...

Medium: dovecot

Issue Overview: Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service resource consumption via an incomplete SSL/TLS handshake for an IMAP/POP3 connection. Affected...

McAfee Email Gateway OpenSSL Multiple Vulnerabilities (SB10075)

The remote host is running a version of McAfee Email Gateway MEG that is affected by the multiple vulnerabilities related to the included OpenSSL library : - An error exists in the function 'ssl3readbytes' that can allow data to be injected into other sessions or allow denial of service attacks...

HP System Management Homepage < 7.2.4.1 / 7.3.3.1 OpenSSL Multiple Vulnerabilities

According to the web server's banner, the version of HP System Management Homepage SMH hosted on the remote web server has an implementation of the OpenSSL library that is affected by the following vulnerabilities : - An error exists in the ssl3readbytes function that allows data to be injected...

Microsoft Windows Media Services 4.0/4.1 Handshake Sequence DoS

No description provided by source. source: http://www.securityfocus.com/bid/1000/info Misordered handshake sequences sent to a Windows Media Unicast Server via Windows Media Player will cause the server to crash. Restarting the Unicast Service, including any open sessions during the time of the...

Counter Strike 2D <= 0.1.0.1 - Denial of Service Vulnerability

No description provided by source. / Counter Strike 2D DoS Affected versions: 0.1.0.1 and prior CS2D Developer: http://www.cs2d.com/ by Iman Karim [email protected] http://home.inf.fh-rhein-sieg.de/ikarim2s/ Written in Borland C++ Builder 6 20.09.2005 / include winsock.h...

Netscape Enterprise Server 3.51/3.6 SP2 Accept Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/631/info Enterprise Server 3.6 SP2 with the SSL Handshake Patch applied is vulnerable to a buffer overflow that may allow attackers to launch denial-of-service attacks and to execute arbitrary commands on the webserver. G...

OpenSSL <= 0.9.8k, 1.0.0-beta2 DTLS Remote Memory Exhaustion DoS

No description provided by source. / cve-2009-1378.c OpenSSL = 0.9.8k, 1.0.0-beta2 DTLS Remote Memory Exhaustion DoS Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1378 In dtls1processoutofseqmessage the check if the...

dovecot: denial of service through maxxing out SSL connections

Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service resource consumption via an incomplete SSL/TLS handshake for an IMAP/POP3 connection...

USN-2232-3 openssl regression

USN-2232-1 fixed vulnerabilities in OpenSSL. The upstream fix for CVE-2014-0224 caused a regression for certain applications that use renegotiation, such as PostgreSQL. This update fixes the problem. Original advisory details: Jüri Aedla discovered that OpenSSL incorrectly handled invalid DTLS...

AIX OpenSSL Advisory : openssl_advisory9.doc

The version of OpenSSL installed on the remote host is potentially affected by the following remote code execution and denial of service vulnerabilities : - OpenSSL could allow an attacker to cause a buffer overrun situation when an attacker sends invalid DTLS fragments to an OpenSSL DTLS client ...

openSUSE Security Update : chromium (openSUSE-SU-2014:0327-1)

Chromium was updated to 33.0.1750.117 Stable channel update : - Security Fixes : - CVE-2013-6653: Use-after-free related to web contents - CVE-2013-6654: Bad cast in SVG - CVE-2013-6655: Use-after-free in layout - CVE-2013-6656: Information leak in XSS auditor - CVE-2013-6657: Information leak in...

openSUSE Security Update : tor (openSUSE-SU-2014:0719-1) (Heartbleed)

tor 0.2.4.22 bnc878486 Tor was updated to the recommended version of the 0.2.4.x series. - major features in 0.2.4.x : - improved client resilience - support better link encryption with forward secrecy - new NTor circuit handshake - change relay queue for circuit create requests from size-based...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64 (20140605)

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. CVE-2014-0224 Note: In order to...

ssl-ccs-injection NSE Script

Detects whether a server is vulnerable to the SSL/TLS "CCS Injection" vulnerability CVE-2014-0224, first discovered by Masashi Kikuchi. The script is based on the ccsinjection.c code authored by Ramon de C Valle In order to exploit the vulnerablity, a MITM attacker would effectively do the...

Code injection

SChannel in Microsoft Internet Explorer 6 through 11 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake...

CVE-2014-1771

CVE-2014-1771 affects Microsoft Internet Explorer 6–11 with SChannel, where during TLS renegotiation the server certificate may differ from the pre-renegotiation one. This allows MITM attackers to obtain sensitive information or modify TLS session data via a triple handshake attack. Public exploi...