Scientific Linux Security Update : nss and nspr on SL6.x i386/x86_64 (20140722)

A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application. CVE-2014-1544 A flaw was found in the way TLS False Start...

RHEL 6 : nss and nspr (RHSA-2014:0917)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0917 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

nss: IDNA hostname matching code does not follow RFC 6125 recommendation (MFSA 2014-45)

It was found that the implementation of Internationalizing Domain Names in Applications IDNA hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid...

perl LWP::Protocol::https certificates check vulnerability

Certificate check is completely disabled if hostname check was disabled...

DEBIAN-CVE-2013-4352

The cacheinvalidate function in modules/cache/cachestorage.c in the modcache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service NULL pointer dereference and daemon crash via vectors that trigger a missing hostna...

CVE-2013-4352

The cacheinvalidate function in modules/cache/cachestorage.c in the modcache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service NULL pointer dereference and daemon crash via vectors that trigger a missing hostna...

USN-2292-1 liblwp-protocol-https-perl vulnerability

It was discovered that the LWP::Protocol::https perl module incorrectly disabled peer certificate verification completely when only hostname verification was requested to be disabled. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could possibly be exploited i...

Domain Analyzer Security Tool - Finds all the security information for a given domain name

Domain analyzer is a security analysis tool which automatically discovers and reports information about the given domain. Its main purpose is to analyze domains in an unattended way. Features It creates a directory with all the information, including nmap output files. It uses colors to remark...

Michael Sandrof IrcII 4.4 -7 Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1046/info IrcII is a well-known Internet Relay Chat IRC client for unix. Version 4.4-7 and possibly previous versions are known to be vulnerable to a buffer overflow condition in their direct client-to-client DCC chat...

Gnome-PTY-Helper UTMP Hostname Spoofing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15004/info 'gnome-pty-helper' is susceptible to a local UTMP hostname spoofing vulnerability. This issue is due to the failure of the application to properly validate user-supplied data prior to using it to update UTMP...

Kroum Grigorov KpyM Telnet Server 1.0 - Remote Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9379/info KpyM Telnet Server has been reported to be prone to a remote denial of service vulnerability. Due to a lack of resource limitations, a remote attacker may negotiate multiple connections to the affected server...

IF-CMS <= 2.0 (frame.php id) Blind SQL Injection Exploit

No description provided by source. --+++=======================================================+++-- --+++====== IF-CMS = 2.0 Blind SQL Injection Exploit ======+++-- --+++=======================================================+++-- ?php function query $username, $char, $pos //Increase benchmark...

Jason Maloney's Guestbook 3.0 - Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9139/info A vulnerability has been reported in Jason Maloney's Guestbook that could result in remote command execution with the privileges of the web server. The problem occurs due to the application failing to sanitize...

Qpopper 3/4 Username Information Disclosure Weakness

No description provided by source. source: http://www.securityfocus.com/bid/7110/info An information disclosure weakness has been reported for Qpopper when authenticating. The weakness is due to the fact that if a valid username is sent with a bad password, Qpopper will wait a small amount of tim...

phpMyAdmin 2.5.7 - Remote code injection Exploit

No description provided by source. / phpmy-explt.c written by Nasir Simbolon nasir kecapi com eagle kecapi com Jakarta, Indonesia June, 10 2004 A phpMyAdmin-2.5.7 exploite program. This is a kind of mysql server wrapper acts like a proxy except that it will sends a fake table name, when client...

HP OpenView Network Node Manager getnnmdata.exe (Hostname) CGI Buffer Overflow

No description provided by source. $Id: hpnnmgetnnmdatahostname.rb 12131 2011-03-25 00:46:59Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and ter...

Microsoft Message Queueing Service Path Overflow

No description provided by source. $Id: ms05017msmq.rb 9262 2010-05-09 17:45:00Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

aGSM 2.35 Half-Life Server Info Response Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10989/info aGSM is reported prone to a remote buffer overflow vulnerability. The issue presents itself in the aGSM server information parsing routines for Half-Life game servers. Due to a lack of sufficient bounds checkin...

Jakarta Slide <= 2.1 RC1 Remote File Disclosure Exploit

No description provided by source. !/usr/bin/perl Jakarta Slide Remote File Disclosure Zeroday Xploit eliteb0y / 2007 thanx to the whole team & andi : +++KEEP PRIV8+++ This Bug may reside in different WebDav implementations, Warp your mind! +You will need auth for the exploit to work... use...

Microsoft Windows NT 4.0/4.0 SP1/4.0 SP2/4.0 SP3 DoS Duplicate Hostname Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/298/info NT Workstations and Servers must have unique hostnames if they reside on the same network. Should an NT host attempt to use an existing hostname, the second server with the new duplicate name will fail to start i...