Microsoft Windows Kerberos Encryption Standard Spoofing Vulnerability

Description The Microsoft Windows implementation of Kerberos is prone to a security vulnerability that may allow attackers to downgrade the cipher suite. Successful exploits may allow attackers to change the default encryption standard to DES. This may allow attackers to read and forge all Kerber...

spice activex/spicec named pipe races

Race condition in the SPICE aka spice-activex plug-in for Internet Explorer in Red Hat Enterprise Virtualization RHEV Manager before 2.2.4 allows local users to create a certain named pipe, and consequently gain privileges, via vectors involving knowledge of the name of this named pipe, in...

Apple Releases Security Update 2010-005

Apple has released security update 2010-005 to address multiple vulnerabilities affecting the ATS, CFNetwork, ClamAV, CoreGraphics, libsecurity, PHP, and Samba applications. These vulnerabilities may allow an attacker to execute arbitrary code, obtain sensitive information, cause a...

CVE-2010-2757

The sudo feature in Bugzilla 2.22rc1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 does not properly send impersonation notifications, which makes it easier for remote authenticated users to impersonate other users without discovery...

Zemana AntiLogger 'AntiLog32.sys' 1.5.2.755 - Local Privilege Escalation

Zemana AntiLogger AntiLog32.sys elfanew; PVOID waddr = &pnthdr-OptionalHeader.DataDirectoryIMAGEDIRECTORYENTRYSECURITY.VirtualAddress ; ULONG oldp ; VirtualProtectwaddr , sizeofULONG , PAGEREADWRITE , &oldp; pnthdr-OptionalHeader.DataDirectoryIMAGEDIRECTORYENTRYSECURITY.VirtualAddress = 0x1 ;...

ProFTPD < 1.3.2b, 1.3.3 - 1.3.3.rc1 SSL Certificate Validation Bypass Vulnerability

ProFTPD is prone to a security bypass vulnerability because the application fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might b...

MS09-056: Vulnerabilities in Windows CryptoAPI Could Allow Spoofing (974571)

The remote Windows host contains a version of the Microsoft Windows CryptoAPI that is affected by multiple vulnerabilities : - A spoofing vulnerability exists in the Microsoft Windows CryptoAPI component when parsing ASN.1 information from X.509 certificates. An attacker who successfully exploite...

CVE-2008-6910

Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not use timeouts for signed requests, which allows remote attackers to impersonate other users and gain privileges via a replay attack that sends the same request...

Mozilla NSS NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

Mozilla NSS NULL Character CA SSL Certificate Validation Security Bypass Vulnerability. CVE-2009-2408. Remote exploit for linux platform source: http://www.securityfocus.com/bid/35888/info Mozilla Network Security Services NSS is prone to a security-bypass vulnerability because it fails to proper...

CVE-2009-0089: Improper Input Validation

Windows HTTP Services aka WinHTTP in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Vista Gold allows remote web servers to impersonate arbitrary https web sites by using DNS spoofing to "forward a connection" to a different https web site that has a valid certificate...

Microsoft WinHTTP Server Name Mismatch Certificate Validation Security Bypass Vulnerability

Description Microsoft Windows HTTP Services WinHTTP is prone to a security-bypass vulnerability because of an error in verifying website certificates. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further...

JVN#63511247 Access Analyzer CGI Professional Version vulnerability allows third party to gain administrative privileges

Access Analyzer CGI provided by futomi's CGI Cafe is a software to analyze web access logs. Access Analyzer CGI Professional Version contains a vulnerability that allows an attacker to gain administrative privileges. Impact A remote attacker could impersonate an administrator of Access Analyzer C...

Reporting Plugin- Cross-site scripting error

Our e-security found the following error for the Reporting plugin: Number System/Location Defect Type Status R2 Reporting Plugin Client-side Attacks: Cross-site Scripting Open Description Security Risk: It is possible to steal or manipulate customer session and cookies, which may be used to...

Gentoo Security Advisory GLSA 200407-15 (opera)

The remote host is missing updates announced in advisory GLSA 200407-15. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

FreeBSD Ports: heimdal

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Cross site scripting

Mulatiple cross-site scripting XSS vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 toid parameter to send-private-message.asp and the 2 redirect parameter to admin/impersonate.asp. NOTE: vector 2 requires authentication...

MegaBBS Forum 2.2 (SQL/XSS) Multiple Remote Vulnerabilities

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: MegaBBS Forum Multiple Vulnerabilities. Vendor: http://www.pd9soft.com/ Vulnerable Version: 2.2 Exploit: Available Impact: Medium Fix: N/A Original Advisory: http://bugreport.ir/index.php?/37 1. Descriptio...

CVE-2007-3418

The displaypost function in cgi-bin/cgi-lib/forumdisplay.pl in web-app.org WebAPP before 0.9.9.7 does not display usernames in conjunction with real names, which makes it easier for remote authenticated users to impersonate other users...

Cisco Security Monitoring, Analysis and Response System and Adaptive Security Device Manager Secure Communication Vulnerability

Cisco Security Monitoring, Analysis and Response System versions prior to 4.2.3 and Cisco Adaptive Security Device Manager versions prior to 5.22.1 contain a vulnerability that could allow an unauthenticated, remote attacker to impersonate a device managed by the system. The vulnerability exists...

JVN#73705637 ACollab SQL injection vulnerability

Impact A remote attacker could modify the database contents or steal data. An attacker could also bypass authentication and impersonate a user. Solution Products Affected ACollab 1.2 and earlier Development and maintenance of ACollab finished with version 1.2 as of July 6, 2006. However ATutor...