SeaMonkey < 2.23 Multiple Vulnerabilities

The installed version of SeaMonkey is earlier than 2.23 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. CVE-2013-5609, CVE-2013-5610 - Cross-site scripting...

Firefox < 26.0 Multiple Vulnerabilities (Mac OS X)

The installed version of Firefox is earlier than 26.0 and is, therefore, potentially affected by multiple vulnerabilities : - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. CVE-2013-5609, CVE-2013-5610 - An issue exists where the...

Thunderbird < 24.2 Multiple Vulnerabilities (Mac OS X)

The installed version of Thunderbird is earlier than 24.2 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. CVE-2013-5609, CVE-2013-5610 - Two use-after-free...

Firefox 26 Makes Java Plugins Click-to-Play, Fixes 14 Security Flaws

Mozilla has released a major new version of Firefox, which includes fixes for more than a dozen security vulnerabilities as well as an important change that makes all Java plugins click-to-play be default. This feature prevents those plugins from running automatically on Web pages, which helps...

[Evil Foca] IPv4 and IPv6 Penetration testing tool

Evil Foca is a tool for Pentesters and Security Auditors to perform security testing in IPv4/ IPv6 data networks. The tool is capable to do different attacks such as: MITM on IPv4 networks using ARP Spoofing and DHCP ACK injection. MITM on IPv6 networks using Neighbor Advertisement Spoofing, SLAA...

Code injection

maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle MITM attack...

CVE-2013-1058

The CVE-2013-1058 entry affects MAAS: the component maas-import-pxe-files in MAAS prior to 13.10 does not cryptographically verify downloaded content, allowing an attacker to modify images via a MITM. Impact: potential integrity compromise of downloaded PXE/boot data. Affected version line is MAA...

Facebook Open_Redirector/Broken_Authentecation exploit

This exploit includes two vulnerabilities at Facebook: 1- An Open Redirector at the mobile domain m.facebook.com which is hard to detect due to its special mechanism and harder to get fixed fully because it requires an non simple change at the platform to get fully patched and it could be exploit...

MOXA EDR-G903 Series Multiple Vulnerabilities

OVERVIEW This advisory provides mitigation details for vulnerabilities that impact Moxa EDR-G903 Series Routers. Independent researcher Neil Smith identified a hard-coded user account vulnerability and an insufficient entropy vulnerability in Moxa’s EDR-G903 series routers. By impersonating the...

Default configuration

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2013-4436

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

PYSEC-2013-26

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2013-4436

CVE-2013-4436 concerns SaltStack’s salt-ssh default configuration (Salt 0.17.0) that does not validate the SSH host key, enabling MITM-style impact. Multiple connected sources (GHSA-F22J-37JJ-CXW9, OSV, NVD variant) corroborate the MITM risk but do not provide exploit details. A remediation menti...

CVE-2013-4436

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2012-0825

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle MITM attack...

CVE-2012-0825

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle MITM attack...

CVE-2012-0825

Removed by vendor...

CVE-2012-0825

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle MITM attack...

CVE-2012-0825

CVE-2012-0825 affects Drupal 6.x up to 6.23 and 7.x up to 7.11, where Attribute Exchange (AX) information is not signed, enabling MITM modification of AX data. Related advisories confirm this CVE in multiple distributions (e.g., Debian DSA-2776-1; MiracleLinux AXSA-2012-98:01). Remediation in aff...

Puppet Enterprise < 3.0.1 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise install on the remote host is a version prior to 3.0.1. As a result, it reportedly has multiple vulnerabilities: - An error exists related to the included Ruby SSL client that could allow man-in-the-middle attacks. CVE-2013-4073...