CVE-2010-3852

CVE-2010-3852 affects Luci ( Luci 0.22.4 and earlier ) used in Red Hat Conga. The root cause is a weak default cookie secret key, rendered as [INSERT SECRET HERE], which enables remote attackers to forge a cookie and bypass repoze.who authentication. The vulnerability impact is partial confidenti...

CVE-2010-3852

The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "INSERT SECRET HERE" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie...

Fedora 14 : luci-0.22.4-2.0.b9faf868074git.fc14 (2010-16848)

Fix CVE-2010-3852 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Networ...

PT-2010-5121 · Red Hat · Luci

Name of the Vulnerable Software and Affected Versions: Luci versions 0.22.4 and earlier Description: The default configuration of Luci in Red Hat Conga uses a static secret key for cookies, which makes it easier for remote attackers to bypass authentication via a forged ticket cookie...

[SECURITY] Fedora 14 Update: luci-0.22.4-2.0.b9faf868074git.fc14

Luci is a web-based high availability administration application built on t he TurboGears 2 framework...

Fedora 13 : luci-0.22.4-2.0.b9faf868074git.fc13 (2010-16617)

Fix CVE-2010-3852 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Networ...

Fedora 12 : luci-0.22.4-2.0.b9faf868074git.fc12 (2010-16601)

Fix CVE-2010-3852 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Networ...

[SECURITY] Fedora 12 Update: luci-0.22.4-2.0.b9faf868074git.fc12

Luci is a web-based high availability administration application built on t he TurboGears 2 framework...

[SECURITY] Fedora 13 Update: luci-0.22.4-2.0.b9faf868074git.fc13

Luci is a web-based high availability administration application built on t he TurboGears 2 framework...

Moderate: Red Hat Security Advisory: conga security, bug fix, and enhancement update

Packages have been updated to include PowerPC and xenU packages. Updated conga packages that fix a security flaw, several bugs, and add enhancements are now available for Red Hat Cluster Suite. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Th...

conga security, bug fix, and enhancement update

0.10.0-6.el5.0.1 - Replaced Redhat copyrighted and trademarked images in the conga-0.10.0 tarball. 0.10.0-6 - Fixed bz253783 - Fixed bz253914 conga doesn't allow you to reuse nfs export and nfs client resources - Fixed bz254038 Impossible to set many valid quorum disk configurations via conga -...

Moderate: Red Hat Security Advisory: conga security, bug fix, and enhancement update

Updated conga packages that correct a security flaw and provide bug fixes and add enhancements are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Conga package is a web-based administration tool for remote cluster and storag...

Design/Logic Flaw

The luci server component in conga preserves the password between page loads for the Add System/Cluster task flow by storing the password in the Value attribute of a password entry field, which allows attackers to steal the password by performing a "view source" or other operation to obtain the w...

CVE-2007-1462

The luci server component in conga preserves the password between page loads for the Add System/Cluster task flow by storing the password in the Value attribute of a password entry field, which allows attackers to steal the password by performing a "view source" or other operation to obtain the w...

CVE-2007-1462

The CVE-2007-1462 issue affects the luci server component in Conga, where a password is stored in the Value attribute of a password field between page loads. This enables a password disclosure through page source viewing or similar operations; impact is partial confidentiality loss as noted, with...

CVE-2007-1462

The luci server component in conga preserves the password between page loads for the Add System/Cluster task flow by storing the password in the Value attribute of a password entry field, which allows attackers to steal the password by performing a "view source" or other operation to obtain the w...

PT-2007-2856 · Conga · Conga

Name of the Vulnerable Software and Affected Versions: conga affected versions not specified Description: The issue concerns the luci server component in conga, where the password is preserved between page loads for the Add System/Cluster task flow. This is done by storing the password in the Val...

security flaw

The luci server component in conga preserves the password between page loads for the Add System/Cluster task flow by storing the password in the Value attribute of a password entry field, which allows attackers to steal the password by performing a "view source" or other operation to obtain the w...