Debian DLA-952-1 : kde4libs security update

Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2017-6410 Itzik Kotler, Yonatan Fridburg and Amit Klein of Safebreach Labs reported that URLs are not...

DEBIAN-CVE-2017-8422

KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app...

Spoofing in Terminal Server Agent

A spoofing vulnerability exists in Terminal Server Agent ref PAN-67269 / CVE-2017-5328. Terminal Server Agent contains a vulnerability whereby a user can spoof the identity of another authenticated user. This issue affects Terminal Server Agent 6.0; Terminal Server Agent 7.0.6 and earlier Work...

MS13-040: Description of the security update for the .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: May 14, 2013

MS13-040: Description of the security update for the .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: May 14, 2013 View products that this article applies to. Introduction Resolves a vulnerability in the Microsoft .NET Framework that could allow identity...

Cisco Unified Communications Manager Mobile and Remote Access Security Bypass Vulnerability

Cisco Unified Communications Manager CUCM, Unified CM is a call-processing component of a unified communications system from the American company Cisco. A security vulnerability exists in CUCM's Mobile and Remote Access MRA service implementation. A remote attacker could exploit this vulnerabilit...

WSO2 Identity Server 4.5.0 / 4.6.0 / 5.0.0 Bypass / Cross Site Scripting

Hi, WSO2 Identity Server http://wso2.com/products/identity-server/ version 4.5.0/4.6.0/5.0.0 is prone to multiple vulnerabilities, including authentication bypass. Timeline: 09.10.2014 - Vendor notified 22.11.2014 - Vendor confirmed 04.12.2014 - Patches released 25.03.2015 - Bugtraq disclosure...

Cisco AnyConnect Secure Mobility Client Identity Spoofing Vulnerability

Cisco AnyConnect Secure Mobility is a secure enterprise mobility solution. An identity spoofing vulnerability exists in the Cisco AnyConnect Secure Mobility Client, which allows remote attackers to spoof forms of authentication and capture credentials via unspecified vectors...

CVE-2014-2684: Undefined Security Weakness

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 does not verify that the openidopendpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remo...

CVE-2014-2684

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 does not verify that the openidopendpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remo...

PT-2014-4870

Name of the Vulnerable Software and Affected Versions Zend Framework 1 versions prior to 1.12.4 ZendOpenId versions prior to 2.0.2 Description The issue allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenI...

Design/Logic Flaw

Red Hat JBoss Operations Network JON before 2.4.2 and 3.0.x before 3.0.1 does not check the JON agent key, which allows remote attackers to spoof the identity of arbitrary agents via the registered agent name...

CVE-2012-0052: Improper Input Validation

Red Hat JBoss Operations Network JON before 2.4.2 and 3.0.x before 3.0.1 does not check the JON agent key, which allows remote attackers to spoof the identity of arbitrary agents via the registered agent name...

User Identity Spoofing in Bitrix Site Manager

Advisory ID: HTB23183 Product: Bitrix Site Manager Vendor: Bitrix, Inc Vulnerable Versions: 12.5.13 and probably prior Tested Version: 12.5.13 Advisory Publication: November 6, 2013 without technical details Vendor Notification: November 6, 2013 Vendor Patch: November 12, 2013 Public Disclosure:...

User Identity Spoofing in Bitrix Site Manager

High-Tech Bridge Security Research Lab discovered vulnerability in Bitrix Site Manager, which can be exploited to spoof user's identity and read, modify or delete pre-ordered items in customer's basket. 1 User Identity Spoofing in Bitrix Site Manager: CVE-2013-6788 The vulnerability exists due to...

CVE-2012-4092

The management interface in the Central Software component in Cisco Unified Computing System UCS does not properly validate the identity of vCenter consoles, which allows man-in-the-middle attackers to read or modify an inter-device data stream by spoofing an identity, aka Bug ID CSCtk00683...

CVE-2012-4741

The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication for users with custom VLAN assignment extensions, which allows remote attackers to spoof user identities via the User-Name RADIUS attribute...

CVE-2012-4741: Improper Authentication

The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication for users with custom VLAN assignment extensions, which allows remote attackers to spoof user identities via the User-Name RADIUS attribute...

PT-2012-5567

Name of the Vulnerable Software and Affected Versions PacketFence versions prior to 3.3.0 Description The issue concerns the RADIUS extension in PacketFence, where it uses a different user name than the one used for authentication for users with custom VLAN assignment extensions. This allows remo...

FreeBSD : mozilla -- multiple vulnerabilities (380e8c56-8e32-11e1-9580-4061862b8c22)

The Mozilla Project reports : MFSA 2012-20 Miscellaneous memory safety hazards rv:12.0/ rv:10.0.4 MFSA 2012-21 Multiple security flaws fixed in FreeType v2.4.9 MFSA 2012-22 use-after-free in IDBKeyRange MFSA 2012-23 Invalid frees causes heap corruption in gfxImageSurface MFSA 2012-24 Potential XS...

Mozilla: Potential site identity spoofing when loading RSS and Atom feeds (MFSA 2012-33)

Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to spoof the address bar via an https URL for invalid 1 RSS or 2 Atom XML content...