CVE-2014-4686

Siemens SIMATIC WinCC (before 7.3) contains a hard-coded encryption key in the Project administration component, enabling remote attackers to extract the key from another installation and use it to sniff traffic on TCP port 1030. This can lead to credential exposure and elevated privileges. Publi...

WebTitan Default Credentials (ssh)

The account 'admin' is using a default password. A remote, unauthenticated attacker could exploit this to log in as a privileged user and gain access to the WebTitan configuration menu. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid76777; scriptversion"$Revision: 1....

CVE-2014-1544

Use-after-free vulnerability in the CERTDestroyCertificate function in libnss3.so in Mozilla Network Security Services NSS 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger...

DEBIAN-CVE-2014-1544

Use-after-free vulnerability in the CERTDestroyCertificate function in libnss3.so in Mozilla Network Security Services NSS 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger...

Design/Logic Flaw

Use-after-free vulnerability in the CERTDestroyCertificate function in libnss3.so in Mozilla Network Security Services NSS 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger...

Critical: nss

Issue Overview: Use-after-free vulnerability in the CERTDestroyCertificate function in libnss3.so in Mozilla Network Security Services NSS 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors...

CVE-2014-1544: Undefined Security Weakness

Use-after-free vulnerability in the CERTDestroyCertificate function in libnss3.so in Mozilla Network Security Services NSS 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger...

nss: TOCTOU, potential use-after-free in libssl's session ticket processing (MFSA 2014-12)

A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application...

nss: false start PR_Recv information disclosure security issue

A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server...

nss: Race-condition in certificate verification can lead to Remote code execution (MFSA 2014-63)

A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application...

UBUNTU-CVE-2014-1544

Use-after-free vulnerability in the CERTDestroyCertificate function in libnss3.so in Mozilla Network Security Services NSS 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger...

CVE-2014-4980 Parameter Tampering in Nessus Web UI - Remote Information Disclosure

Product: Nessus Vendor: Tenable Network Security? Version: Nessus 5.2.3-5.2.7 - Web UI 2.3.4 potentially lower Vendor Notified Date: June 24, 2014 Vendor Resolved Date: June 25, 2014 Release Date: July 18, 2014 Risk: Medium Authentication: Not Required Remote: Yes Description: A parameter tamperi...

PwnPi - A Pen Test Drop Box distro for the Raspberry Pi

PwnPi is a Linux-based penetration testing dropbox distribution for the Raspberry Pi. It currently has 200+ network security tools pre-installed to aid the penetration tester. It is built a stripped down version of the Debian Wheezy image from the Raspberry Pi foundation's website and uses Openbo...

Point-of-Sale Dealers Need a Security Sit-Down

The travails of small retail and hospitality businesses struggling with hackers have been documented for years in the annual Verizon Data Breach Investigations Report. Mom-and-pop businesses, small restaurants and regional hotel chains are perfect targets of opportunity for attackers adept at...

Oracle iPlanet Web Server 7.0.x < 7.0.20 Multiple Vulnerabilities

According to its self-reported version, the Oracle iPlanet Web Server formerly Sun Java System Web Server running on the remote host is 7.0.x prior to 7.0.20. It is, therefore, affected by the following vulnerabilities in the Network Security Services NSS : - The implementation of NSS does not...

LibreOffice < 4.2.5 Unspecified Macro Code Execution

A version of LibreOffice is installed on the remote Windows host that is between versions 4.1.4 and 4.2.4. It is, therefore, affected by a vulnerability that allows the execution of unspecified VBA macros automatically. Note that Nessus has not attempted to exploit this issue, but has instead...

Oracle GlassFish Server Multiple Vulnerabilities (July 2014 CPU)

The version of GlassFish Server running on the remote host is affected by multiple vulnerabilities in the following components : - The implementation of Network Security Services NSS does not ensure that data structures are initialized, which could result in a denial of service or disclosure of...

Fedora 19 : python-2.7.5-13.fc19 (2014-7772)

Fix for CVE-2014-4616 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Fedora 19 : lz4-r119-1.fc19 (2014-8112)

New release - Fixed a high Address allocation issue in 32-bits mode. - New release r118 - Fixed packaging issues. - install libraries under %libdir directory. - New release r118 - Fixed packaging issues. - install libraries under %libdir directory. - New release r118 - Fixed packaging issues. -...

Ubuntu 12.04 LTS / 13.10 : libav vulnerabilities (USN-2277-1)

It was discovered that Libav incorrectly handled certain malformed media files. If a user were tricked into opening a crafted media file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Not...