Security Best Practice: Familiarize Yourself with the Non Compliant HTTP Protection

HTTP Protocol Inspection provides strict enforcement of the HTTP protocol, ensuring these sessions comply with RFC standards and common security practices...

US-CERT Technical Cyber Security Alert TA08-162A -- SNMPv3 Authentication Bypass Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA08-162A SNMPv3 Authentication Bypass Vulnerability Original release date: June 10, 2008 Last revised: -- Source: US-CERT Systems Affected Multiple Implementations of SNMPv3 Overview A...

RHEL 5 : bind (RHSA-2008:0300)

"Updated bind packages that fix two security issues, several bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Berkeley Internet Name Domain BIND is an implementatio...

Moderate: Red Hat Security Advisory: bind security, bug fix, and enhancement update

Updated bind packages that fix two security issues, several bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Berkeley Internet Name Domain BIND is an implementation...

CVE-2008-2143

Unspecified versions of Microsoft Outlook Web Access OWA use the Cache-Control: no-cache HTTP directive instead of no-store, which might cause web browsers that follow RFC-2616 to cache sensitive information...

Design/Logic Flaw

Unspecified versions of Microsoft Outlook Web Access OWA use the Cache-Control: no-cache HTTP directive instead of no-store, which might cause web browsers that follow RFC-2616 to cache sensitive information...

CVE-2008-2143

CVE-2008-2143 affects unspecified Microsoft Outlook Web Access (OWA) versions. The underlying issue is that OWA uses Cache-Control: no-cache instead of no-store, which may allow browsers following RFC-2616 to cache sensitive information. Impact is potential exposure of cached data; no exploitatio...

CVE-2008-2143

Unspecified versions of Microsoft Outlook Web Access OWA use the Cache-Control: no-cache HTTP directive instead of no-store, which might cause web browsers that follow RFC-2616 to cache sensitive information...

LPD Detection

The remote service supports the line printer daemon lpd protocol, which is widely-used by print servers. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid30207; scriptversion"1.11"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"LPD Detection";...

XOT Detection

The remote target is an XOT router. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid30122; scriptversion "1.14"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish: "XOT Detection"; scriptsetattributeattribute:"synopsis", value: "This plugin detects XOT X.25 over TCP....

Moderate: Red Hat Security Advisory: httpd security update

Updated Apache httpd packages that fix several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular Web server. A flaw was found in the modimap...

SUN Java Runtime Environment DoS

NULL pointer dereference on HTML-embedded RFC 2397 encoded applets...

FreeBSD : wireshark -- multiple vulnerabilities (8a835235-ae84-11dc-a5f9-001a4d49522b)

The Wireshark team reports of multiple vulnerabilities : - Wireshark could crash when reading an MP3 file. - Beyond Security discovered that Wireshark could loop excessively while reading a malformed DNP packet. - Stefan Esser discovered a buffer overflow in the SSL dissector. - The ANSI MAP...

Apache Httpd < 2.2.8 : mod_proxy_ftp UTF-7 XSS

A workaround was added in the modproxyftp module. On sites where modproxyftp is enabled and a forward proxy is configured, a cross-site scripting attack is possible against Web browsers which do not correctly derive the response character set following the rules in RFC 2616...

Apache Httpd < 2.0.63 : mod_proxy_ftp UTF-7 XSS

A workaround was added in the modproxyftp module. On sites where modproxyftp is enabled and a forward proxy is configured, a cross-site scripting attack is possible against Web browsers which do not correctly derive the response character set following the rules in RFC 2616...

Unfixed XSS vulnerability at rfc-ignorant.org

Security researcher CCC, has submitted on 24/11/2007 a cross-site-scripting XSS vulnerability affecting rfc-ignorant.org, which at the time of submission ranked 368432 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is currently...

SOL8072 - Obtaining uptime information from TCP timestamps

Timestamps are a TCP option used by a TCP/IP networking stack to implement two algorithms: the Round-Trip Time Measurement RTTM algorithm and the Protection Against Wrapped Sequence Numbers PAWS algorithm. Both algorithms are defined in RFC 1323, and are widely implemented by most modern operatin...

Moderate: Red Hat Security Advisory: httpd security update

Updated httpd packages that fix two security issues are now available for Red Hat Application Stack. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular and freely-available Web server. A flaw was found in the...

Cisco IOS on Catalyst 6500 and Cisco 7600 Access Control List Bypass Vulnerability

Cisco IOS running on Catalyst 6500 and Cisco 7600 contains a vulnerability that could allow an unauthenticated, remote attacker to bypass configured ACLs. The vulnerability exists because the affected devices accept traffic to IP addresses that are reserved for use by the Ethernet Out-of-Band...

[Full-disclosure] DOS vulnerability on Thomson SIP phone ST 2030 using an empty packet

MADYNES Security Advisory : Remote DOS on Thomson SIP phone ST 2030 using an empty packet Date of Discovery 15 February, 2007 Vendor was notified on 1 March 2007 ID: KIPH10 Synopsis After sending an empty message the device looks functional but in fact does not respond to any event provoking a Do...