CVE-2008-1676

The CVE-2008-1676 issue concerns Red Hat Certificate System’s PKI Common Framework (rhpki-common) used by RHCS and Netscape Certificate Management System. The root cause is that certificate signing request (CSR) processing did not honor Certificate Authority profile constraints on Extensions, ena...

Important: Red Hat Security Advisory: rhpki-common security update

Updated rhpki-common packages that fix a security issue are now available for Red Hat Certificate System 7.2. This update has been rated as having important security impact by the Red Hat Security Response Team. Red Hat Certificate System RHCS is an enterprise software system designed to manage...

Important: Red Hat Security Advisory: rhpki-common security update

An updated rhpki-common package that fixes a security issue is now available for Red Hat Certificate System 7.3. This update has been rated as having important security impact by the Red Hat Security Response Team. Red Hat Certificate System RHCS is an enterprise software system designed to manag...

n.runs-SA-2008.001 - Jscape Secure FTP Applet

n.runs AG http://www.nruns.com/ securityatnruns.com n.runs-SA-2008.001 23-June-2008 Vendor: Jscape, http://www.jscape.com/ Affected Products: Jscape Secure FTP Applet http://www.jscape.com/sftpapplet/index.html Vulnerability: SSH Host key is not verified allowing for Man in the Middle attacks Ris...

Debian and Ubuntu OpenSSL packages contain a predictable random number generator

Overview A vulnerability in the OpenSSL package included with the Debian GNU/Linux operating system and its derivatives may cause weak cryptographic keys to be generated. Description A weakness exists in the random number generator used by the OpenSSL package included with the Debian GNU/Linux...

Debian OpenSSH/OpenSSL Package Random Number Generator Weakness

The remote SSH host key has been generated on a Debian or Ubuntu system which contains a bug in the random number generator of its OpenSSL library. The problem is due to a Debian packager removing nearly all sources of entropy in the remote version of OpenSSL. An attacker can easily obtain the...

Debian Security Advisory DSA 361-1 (kdelibs)

The remote host is missing an update to kdelibs announced via advisory DSA 361-1. OpenVAS Vulnerability Test $Id: deb3611.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 361-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Code injection

Meridian Prolog Manager 2007, and 7.5 and earlier, sends all usernames and passwords to the client in a 1 cleartext or 2 weakly encrypted format to support client-side login authentication, which makes it easier for remote attackers to obtain database access by capturing credentials via a...

CVE-2007-6330

Meridian Prolog Manager 2007, and 7.5 and earlier, sends all usernames and passwords to the client in a 1 cleartext or 2 weakly encrypted format to support client-side login authentication, which makes it easier for remote attackers to obtain database access by capturing credentials via a...

CVE-2007-6330

Meridian Prolog Manager 2007 and earlier versions (including 7.5 and prior) transmit all usernames and passwords to the client in cleartext or weakly encrypted form to support client-side authentication. This can enable an attacker to capture credentials via network sniffing or a man-in-the-middl...

SuSE 10 Security Update : ruby (ZYPP Patch Number 4702)

This update of ruby improves the SSL certificate verification process. CVE-2007-5162 / CVE-2007-5770 Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell,...

CVE-2007-5355

The Web Proxy Auto-Discovery WPAD feature in Microsoft Internet Explorer 6 and 7, when a primary DNS suffix with three or more components is configured, resolves an unqualified wpad hostname in a second-level domain outside this configured DNS domain, which allows remote WPAD servers to conduct...

[SECURITY] [DSA 1412-1] New ruby1.9 packages fix insecure SSL certificate validation

------------------------------------------------------------------------ Debian Security Advisory DSA-1412-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 24, 2007 http://www.debian.org/security/faq -...

QQ website login RSA encrypted transmission defect analysis-vulnerability warning-the black bar safety net

! QQ Thanks to anonymous people posting QQ website login not using https is encrypted, instead of using the RSA asymmetric encryption to protect transmission of passwords and sensitive information security. QQ is in javascript to achieve the entire process. This idea is very novel, but is also...

Code injection

CFNetwork in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 does not properly validate certificates, which allows remote attackers to spoof trusted SSL certificates via a man-in-the-middle attack...

CVE-2007-4680

CFNetwork in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 does not properly validate certificates, which allows remote attackers to spoof trusted SSL certificates via a man-in-the-middle attack...

CVE-2007-4680

CVE-2007-4680 affects Apple Mac OS X 10.3.9 and 10.4 up to 10.4.10. The flaw is in CFNetwork certificate validation, enabling a remote attacker to perform a man‑in‑the‑middle attack to spoof trusted SSL certificates and potentially leak credentials or other information. The issue is mitigated by ...

Cross site request forgery (csrf)

The 1 Net::ftptls, 2 Net::telnets, 3 Net::imap, 4 Net::pop, and 5 Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName CN field in a server certificate matches the domain name in a request sent over SSL, which makes it easier for remote attackers to intercept SSL...

irb, ruby security update

CentOS Errata and Security Advisory CESA-2007:0961 Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting languag...

Moderate: Red Hat Security Advisory: ruby security update

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for object-oriented programming. A flaw was...