Debian DLA-345-1 : strongswan security update

Tobias Brunner found an authentication bypass vulnerability in strongSwan, an IKE/IPsec suite. Due to insufficient validation of its local state the server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin can be tricked into successfully concluding the authentication without...

[SECURITY] [DLA 345-1] strongswan security update

Package : strongswan Version : 4.4.1-5.8 CVE ID : CVE-2015-8023 Tobias Brunner found an authentication bypass vulnerability in strongSwan, an IKE/IPsec suite. Due to insufficient validation of its local state the server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin can be...

DLA-345-1 strongswan - security update

Bulletin has no description...

Design/Logic Flaw

IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 places session IDs in https URLs, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

The Artillery Project

Artillery is a combination of a honeypot, monitoring tool, and alerting system. Eventually this will evolve into a hardening monitoring platform as well to detect insecure configurations from nix systems. It’s relatively simple, run ./setup.py and hit yes, this will install Artillery in...

Xen Denial of Service Vulnerability (CNVD-2015-07244)

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. A security vulnerability exists in Xen versions 3.2.x through 4.6.x due to the failure of the program to limit the number of printk console messages when logging HYPERCALLxenoprof...

CVE-2009-1296

The eCryptfs support utilities ecryptfs-utils 73-0ubuntu6.1 on Ubuntu 9.04 stores the mount passphrase in installation logs, which might allow local users to obtain access to the filesystem by reading the log files from disk. NOTE: the log files are only readable by root...

TIBCO Spotfire Server Information Disclosure Vulnerability (CNVD-2015-07301)

TIBCO Spotfire Server is based on TIBCO Spotfire data analysis and mining tools of TIBCO Software Inc. of the United States to provide integration, operation and management of the platform for the enterprise. TIBCO Spotfire Server versions 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5....

PT-2015-7061 · Veeam · Veeam Backup & Replication

Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication versions prior to 8.0 update 3 Description: The issue allows local users to obtain sensitive information by reading log files with world-readable permissions, where local administrator credentials are stored. This i...

CVE-2015-4964

IBM UrbanCode Deploy 6.0 and 6.0.1.x before 6.0.1.10, 6.1.1.x before 6.1.1.8, and 6.1.2 writes admin AUTHTOKEN values to execution logs, which allows remote authenticated users to gain privileges by leveraging the ability to create and execute a process...

CVE-2015-4964

IBM UrbanCode Deploy 6.0 and 6.0.1.x before 6.0.1.10, 6.1.1.x before 6.1.1.8, and 6.1.2 writes admin AUTHTOKEN values to execution logs, which allows remote authenticated users to gain privileges by leveraging the ability to create and execute a process...

CVE-2015-4964

IBM UrbanCode Deploy (UCD) vulnerable in versions 6.0 and 6.0.1.x before 6.0.1.10, 6.1.1.x before 6.1.1.8, and 6.1.2. Affected users who can create and execute processes can have the admin AUTH_TOKEN value written to execution logs, enabling privilege escalation by a non-admin user who can run st...

CVE-2015-4964

IBM UrbanCode Deploy 6.0 and 6.0.1.x before 6.0.1.10, 6.1.1.x before 6.1.1.8, and 6.1.2 writes admin AUTHTOKEN values to execution logs, which allows remote authenticated users to gain privileges by leveraging the ability to create and execute a process...

FTGate 2009 SR3 Cross Site Request Forgery

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-FTGATE-2009-CSRF.txt Vendor: ================================ www.ftgate.com Product: ======================================== FTGate 2009 SR3 May 13 2010 Build 6.4.00 Vulnerability...

FTGate 2009 Build 6.4.00 - Multiple Vulnerabilities

Exploit for php platform in category web applications Vendor: ================================ www.ftgate.com Product: ======================================== FTGate 2009 SR3 May 13 2010 Build 6.4.00 Vulnerability Type: ================================= Cross site request forgery CSRF CVE...

Imgur: Server Side Request Forgery In Video to GIF Functionality

imgur.com is vulnerable to Server Side Request Forgery because it fails to sanitize or verify the "url" GET parameter. This could be used by attackers to launch attacks against other 3rd party sites or proxy an attackers requests through the affected site to hide the attackers origin. In more...

Zendesk: CSV Excel Macro Injection Vulnerability in export chat logs

Scenario: An attacker creates a name as =AND21 with a fake email and with random text in the message body. This is similar to a vulnerability recently found in zendesk.com as well. When a team member clicks export as csv and opens it instead of seeing =AND21 they see TRUE. Meaning that cell is no...

Vulnerability of the Windows operating system, allowing a perpetrator to execute arbitrary code

The vulnerability of the Windows operating system is related to insufficient validation of input data during the processing of event logs. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted JNT file...

Vulnerability of the Windows operating system, allowing a perpetrator to execute arbitrary code

The vulnerability of the Windows operating system is related to insufficient validation of input data during the processing of event logs. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted JNT file...

McAfee Threat Intelligence Exchange Secondary Server Information Disclosure Vulnerability

McAfee Threat Intelligence Exchange TIE the United States McAfee McAfee company's set of unified threat defense system to provide security recovery and infection defense capabilities. The system provides comprehensive threat intelligence awareness, instant understanding of the trails of advanced...