Fedora 19 : kernel-3.13.9-100.fc19 (2014-4849)

The 3.13.9 stable update contains a number of important fixes across the tree. The 3.13.8 stable update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

Halon Security Router (SR) =< v3.2-winter-r1 Multiple Vulnerabilities

I found the following security vulnerabilities in Security Router v3.2-winter-r1 and earlier: 1. Reflected Cross-Site Scripting XSS OWASP Top 10 2013-A3 2. Cross-site Request Forgery CSRF OWASP Top 10 2013-A8 3. Open Redirect OWASP Top 10 2013-A10 Vulnerable Software Link:...

Fedora 19 : perl-Authen-Captcha-1.024-1.fc19 (2014-4454)

An issue in previous versions of perl-Authen-Captcha is that the generated public string file name of the picture for the captcha is merely a checksum of the secret string. It is trivial to break such short strings even using google instead of a rainbow table. Version 1.024 of the module fixes...

Ubuntu 12.04 LTS / 12.10 / 13.10 : libyaml-libyaml-perl vulnerabilities (USN-2161-1)

Florian Weimer discovered that libyaml-libyaml-perl incorrectly handled certain large YAML documents. An attacker could use this issue to cause libyaml-libyaml-perl to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2013-6393 Ivan Fratric discovered that...

USN-2159-1: NSS vulnerability

It was discovered that NSS incorrectly handled wildcard certificates when used with internationalized domain names. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to spoof SSL servers...

Why Full Disclosure Still Matters

When the venerable Full Disclosure security mailing list shut down abruptly last month, many in the security community were surprised. But a lot of people, even those who had been members of the list for a long time, greeted the news with a shrug. Twitter, blogs and other outlets had obviated the...

Ubuntu 12.04 LTS : linux-lts-raring vulnerabilities (USN-2158-1)

Stephan Mueller reported an error in the Linux kernel's ansi cprng random number generator. This flaw makes it easier for a local attacker to break cryptographic protections. CVE-2013-4345 Nico Golde and Fabian Yamaguchi reported buffer underflow errors in the implementation of the XFS filesystem...

Fedora 20 : moodle-2.5.5-1.fc20 (2014-4163)

Fixes for CVE-2014-0122, CVE-2014-0123, CVE-2014-0124, CVE-2014-0125, CVE-2014-0126, CVE-2014-0127, CVE-2014-0129. http://docs.moodle.org/dev/Moodle2.6.2releasenotes http://docs.moodle.org/dev/Moodle2.5.5releasenotes http://docs.moodle.org/dev/Moodle2.4.9releasenotes Note that Tenable Network...

Fedora 19 : moodle-2.4.9-1.fc19 (2014-4152)

Fixes for CVE-2014-0122, CVE-2014-0123, CVE-2014-0124, CVE-2014-0125, CVE-2014-0126, CVE-2014-0127, CVE-2014-0129. http://docs.moodle.org/dev/Moodle2.6.2releasenotes http://docs.moodle.org/dev/Moodle2.5.5releasenotes http://docs.moodle.org/dev/Moodle2.4.9releasenotes Note that Tenable Network...

Over 20Gbps DDoS attacks Now Become Common for Hackers

The Distributed Denial of Service DDoS attack has become more sophisticated and complex and therefore has become one of the favorite weapon for the cyber criminals to temporarily suspend the services of any host connected to the Internet and till now nearly every big site had been a victim of thi...

Auditing Network Activity: Argus

Auditing Network Activity Argus is a fixed-model Real Time Flow Monitor designed to track and report on the status and performance of all network transactions seen in a data network traffic stream. Argus provides a common data format for reporting flow metrics such as connectivity, capacity,...

Design/Logic Flaw

The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...

Mozilla Network Security Services 'p12creat.c'内存破坏漏洞

Bugtraq ID:66366 CVE ID:CVE-2014-1492 NSS实现SSL v2/v3, TLS, PKCS5, PKCS7, PKCS11, PKCS12, S/MIME, X.509v3证书和其他安全标准。 Network Security Services "secpkcs12newasafe"函数security/nss/lib/pkcs12/p12creat.c存在错误，允许攻击者利用漏洞破坏内存，使应用程序崩溃或执行任意代码。 0 Network Security Services NSS 3.x Network Security Services...

CVE-2014-1492

The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...

Fedora 20 : jansson-2.6-1.fc20 (2014-3778)

Florian Weimer of the Red Hat Product Security Team found that the hashing implementation in Jansson, a library for encoding, decoding and manipulating JSON data, was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause an application using Jansson to use an...

CVE-2014-1492: Improper Input Validation

The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...

UBUNTU-CVE-2014-1492

The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...

[Argus] Real Time Flow Monitor

Argus is a fixed-model Real Time Flow Monitor designed to track and report on the status and performance of all network transactions seen in a data network traffic stream. Argus provides a common data format for reporting flow metrics such as connectivity, capacity, demand, loss, delay, and jitte...

CVE-2014-2589: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Dashboard Backend service stats/dashboard.jsp in SonicWall Network Security Appliance NSA 2400 allows remote attackers to inject arbitrary web script or HTML via the sn parameter...

PT-2014-4798 · Sonicwall · Sonicwall Network Security Appliance

Name of the Vulnerable Software and Affected Versions: SonicWall Network Security Appliance NSA 2400 Description: The issue is related to a cross-site scripting XSS vulnerability in the Dashboard Backend service, specifically in the stats/dashboard.jsp component. This vulnerability allows remote...