PT-2011-5137

Name of the Vulnerable Software and Affected Versions JRuby versions prior to 1.6.5.1 Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, via crafted input to an application that maintains a hash table. This is due to the computatio...

PT-2011-4958

Name of the Vulnerable Software and Affected Versions Plone versions 4.1.3 and earlier Description The issue allows remote attackers to cause a denial of service by sending many crafted parameters, resulting in CPU consumption due to hash collisions. Recommendations For Plone versions 4.1.3 and...

PT-2011-5121

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 1.8.7-p357 Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, by providing crafted input to an application that maintains a hash table, thus triggering ha...

PT-2011-1244

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.9 Description The issue arises due to insufficient input validation in the PHP language interpreter. This can be exploited by a remote attacker to cause a denial of service, specifically by consuming CPU resources. Th...

PT-2011-4441 · Microsoft · .Net Framework +1

Name of the Vulnerable Software and Affected Versions: Microsoft .NET Framework versions 1.1 SP1 through 4.0 Description: A denial of service issue exists due to the way ASP.NET Framework handles specially crafted requests, causing a hash collision. This allows remote attackers to cause a denial ...

php -- multiple vulnerabilities

php development team reports: Security Enhancements and Fixes in PHP 5.3.9: Added maxinputvars directive to prevent attacks based on hash collisions. CVE-2011-4885 Fixed bug 60150 Integer overflow during the parsing of invalid exif header. CVE-2011-4566...

PT-2011-4957

Name of the Vulnerable Software and Affected Versions Jetty versions 8.1.0.RC2 and earlier Description The issue allows remote attackers to cause a denial of service by sending many crafted parameters, resulting in CPU consumption due to hash collisions. Recommendations For Jetty versions 8.1.0.R...

CVE-2011-5036 rubygem-rack: hash table collisions DoS (oCERT-2011-003)

Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...

Apache Derby 'BUILTIN' Authentication Insecure Password Hashing

According to its self-reported version number, the installation of Apache Derby running on the remote server performs a transformation on passwords that removes half the bits from most of the characters before hashing. This leads to a large number of hash collisions, letting passwords be easily...

DEBIAN-CVE-2011-0539

The keycertify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the nonce field, which might allow remote attackers to obtain sensitive stack memory contents or make it easier to conduct...

PT-2010-1062 · Mingw +6 · Mingw32-Libxml2-Debuginfo +8

Name of the Vulnerable Software and Affected Versions: libxml2 versions prior to 2.8.0 mingw32-libxml2 versions 2.7.6 mingw32-libxml2-debuginfo versions 2.7.6 mingw32-libxml2-static versions 2.7.6 Description: The issue concerns multiple vulnerabilities in the libxml2 package, which can lead to...

Apache Derby Information Disclosure Vulnerability

Apache Derby is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:derby";...

CVE-2009-4269

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...

Design/Logic Flaw

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...

CVE-2009-4269

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...

CVE-2009-4269

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to...

kernel: emergency route cache flushing leads to node deadlock

A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux RHEL 5 allows remote attackers to cause a denial of service deadlock via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chai...

deprecate MD2 in SSL cert validation (Kaminsky)

The Network Security Services NSS library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash...

deprecate MD2 in SSL cert validation (Kaminsky)

The Network Security Services NSS library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash...

deprecate MD2 in SSL cert validation (Kaminsky)

The Network Security Services NSS library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash...