Security Advisory 0006

Security Advisory 0006 PDF Date: September 29th 2014 Revision | Date | Changes ---|---|--- 1.0 | September 29th 2014 | Initial release 1.1 | September 30th 2014 | Additional details on maintenance releases 1.2 | October 29th 2014 | Additional details on fixed releases 1.3 | November 4th 2014 |...

WordPress Coming soon and Maintenance mode Plugin <= 0.5.0 - Multiple Vulnerabilities

This plugin is prone to a cross site scripting and cross site request forgery vulnerabilities. Solution Update the plugin...

Sony PlayStation Network Back Online Following DDoS

Sony Corporation took its online gaming platform, the PlayStation Network PSN, offline over the weekend in the face of a distributed denial of service DDoS attack. As of Sunday, the company said the PSN is back online and that game play can resume. Sony is saying that it has seen no evidence of a...

Symantec Encryption Desktop Compressed Mail File Denial-of-Service

SUMMARY Certain encryption applications permit compression directly in the message body of an encrypted email file. Symantec Encryption Desktop will attempt decompression and decryption of these specifically formatted incoming email files without properly limiting maximum file size during the...

Security Advisory- SSH Username Information Disclosure Vulnerability in Huawei Campus Switch

Some versions of Huawei Campus switch series products S9300/S9300E/S7700/S9700 /S5700/S6700/S5300/S6300/S2300/S2700/S3300/S3700 are affected by username information disclosure vulnerability. When the maintenance terminal of a Huawei Campus switch uses SSH to log in to a server, attackers can gues...

CVE-2014-0609

Unspecified vulnerability in Novell Open Enterprise Server OES 11 SP1 before Scheduled Maintenance Update 9415 and 11 SP2 before Scheduled Maintenance Update 9413 for Linux has unknown impact and attack vectors...

CVE-2014-0609

Unspecified vulnerability in Novell Open Enterprise Server OES 11 SP1 before Scheduled Maintenance Update 9415 and 11 SP2 before Scheduled Maintenance Update 9413 for Linux has unknown impact and attack vectors...

Updated tor package fixes security vulnerability

Tor before 0.2.4.23 maintains a circuit after an inbound RELAYEARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAYEARLY cells as a means of communicating information about hidden service name...

WP Maintenance Mode 1.8.7 - Setting Manipulation CSRF

The WP Maintenance Mode WordPress plugin was affected by a Setting Manipulation CSRF security vulnerability...

Design/Logic Flaw

Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAYEARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAYEARLY cells as a means of communicating...

CVE-2014-5117

Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAYEARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAYEARLY cells as a means of communicating...

CVE-2014-5117

CVE-2014-5117 affects Tor: in Tor 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha, a client can be left with a circuit after an inbound RELAY_EARLY cell, enabling traffic-confirmation via RELAY/RELAY_EARLY patterns. Public advisories across multiple distros (Fedora/OpenSUSE/Mandriva) reference this vulne...

CVE-2014-5117

Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAYEARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAYEARLY cells as a means of communicating...

PowerScripts PlusMail WebConsole 1.0 Poor Authentication Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/2653/info PowerScripts PlusMail Web Control Panel is a web-based administration suite for maintaining mailing lists, mail aliases, and web sites. It is reportedly possible to change the administrative username and passwor...

PHP Nuke 5.0 'user.php' Form Element Substitution Vulnerabilty

No description provided by source. source: http://www.securityfocus.com/bid/3107/info PHP-Nuke is a website creation/maintenance tool written in PHP3. If a malicious user may subtitute arbitrary values for image form elements in the PHP-Nuke User Registration Form by saving the webpage locallyas...

PHPNuke 4.x/5.x SQL_Debug Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3906/info PHPNuke is a website creation/maintenance tool. It is can be back-ended by a number of database products such as MySQL, PostgreSQL, mSQL, Interbase, Sybase, etc. The sqllayer.php script contains a debugging...

Symantec Encryption Desktop for OS X World-Writable Files Insecure File Handling

SUMMARY Symantecs Encryption Desktop for OS X installs some temporary files with world-writable attributes during installation. In a multi-user environment, a malicious user could manipulate these world-writable files to read and write files or create files with another users permissions. AFFECTE...

Mozilla updates 2014/06 (critical)

These updates contain the latest security and maintenance updates for - Mozilla Firefox 24.6esr - Mozilla Thunderbird 24.6 - Mozilla NSPR is also updated to 4.10.6 to fix MFSA 2014-48/CVE-2014-1533/CVE-2014-1534 Miscellaneous memory safety hazards MFSA...

openSUSE Security Update : osc (openSUSE-SU-2012:0400-1)

This update of osc to 0.134.1 provides the following changes : - adding unlock command - maintenanceincident requests get created with source revision of package - Enables new maintenance submissions for new OBS 2.3 maintenance model - Fixes srcmd5 revisions in submit request, when link target !=...

UBUNTU-CVE-2014-3155

net/spdy/spdywritequeue.cc in the SPDY implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service out-of-bounds read by leveraging incorrect queue maintenance...