BEA产品多个远程安全漏洞

BEA Systems WebLogic包含多种应用系统集成方案，包括Server/Express/Integration等。 BEA Weblogic中存在多个安全漏洞，可能允许恶意攻击者获得敏感信息、绕过某些安全限制、导致拒绝服务或完全入侵系统。 这些漏洞包括： 1 SSL库中的漏洞可能允许判断明文块； 2 从缓存重用连接时服务器没有正确地验证客户端证书，导致攻击者可以通过X.509证书访问Web服务器。成功攻击要求应用程序允许通过单个客户端进程访问多个用户； 3 存储在JDBCDataSourceFactory MBean Properties属性中的口令没有加密； 4...

firefox-DoS.txt

!/usr/bin/perl author: tomas kempinsky use strict; use Socket; my $port = shift || 2121; my $proto = getprotobyname'tcp'; my $payload = "\x32\x32\x30\x20\x5a\x0d\x0a\x33". "\x33\x31\x20\x5a\x0d\x0a\x35\x30". "\x30\x20\x44\x6f\x53\x0d\x0a\x35". "\x30\x30\x20\x5a\x0d\x0a"; socketSERVER, PFINET,...

Mozilla Firefox 1.x - XML Handler Race Condition Memory Corruption

Mozilla Firefox 1.x - XML Handler Race Condition Memory Corruption source: https://www.securityfocus.com/bid/19534/info Mozilla Firefox is prone to a remote memory-corruption vulnerability because of a race condition that may result in double-free or other memory-corruption issues. Attackers may...

Mozilla Firefox 1.0.x - JavaScript Handler Race Condition Memory Corruption

source: https://www.securityfocus.com/bid/19488/info Mozilla Firefox is prone to a remote memory-corruption vulnerability. This issue is due to a race condition that may result in double-free or other memory-corruption issues. Attackers may likely exploit this issue to execute arbitrary machine...

Mozilla Firefox 1.0.x - JavaScript Handler Race Condition Memory Corruption

Mozilla Firefox 1.0.x - JavaScript Handler Race Condition Memory Corruption source: https://www.securityfocus.com/bid/19488/info Mozilla Firefox is prone to a remote memory-corruption vulnerability. This issue is due to a race condition that may result in double-free or other memory-corruption...

CVE-2006-2711

CVE-2006-2711 affects Secure Elements Class 5 AVR (C5 EVM) version 2.8.1 and earlier (and possibly later 2.8.x), where the same initialization vector (IV) and key are reused for each message session. This is the underlying root cause stated in the CVE description, enabling remote attackers over a...

CVE-2005-2752

An unspecified kernel interface in Mac OS X 10.4.2 and earlier does not properly clear memory before reusing it, which could allow attackers to obtain sensitive information, a different vulnerability than CVE-2005-1126 and CVE-2005-1406...

CVE-2005-2752

An unspecified kernel interface in Mac OS X 10.4.2 and earlier does not properly clear memory before reusing it, which could allow attackers to obtain sensitive information, a different vulnerability than CVE-2005-1126 and CVE-2005-1406...

CVE-2005-2752

Mac OS X kernel information leaks (CVE-2005-2752) are described in connected sources as flaws in the xnu kernel where certain code paths do not initialize buffers before copying to user space, potentially leaking kernel memory. The issue affects Mac OS X 10.3.x and 10.4.x (and is noted as a relat...

DEBIAN-CVE-2005-2970

Memory leak in the worker MPM worker.c for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service memory consumption via aborted connections, which prevents the memory for the transaction pool from being reused for other connections...

security flaw

OpenLDAP 1.0 through 2.1.19, as used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other operating systems, may allow certain authentication schemes to use hashed crypt passwords in the userPassword attribute as if they were plaintext passwords, which allows remote attackers to re-use hashed...

D-Link DSL Router - Remote Authentication Bypass

D-Link DSL Router - Remote Authentication Bypass source: https://www.securityfocus.com/bid/13679/info Various D-Link DSL routers are susceptible to a remote authentication bypass vulnerability. This issue is due to a failure of the devices to require authentication in certain circumstances. This...

D-Link DSL Router - Remote Authentication Bypass

source: https://www.securityfocus.com/bid/13679/info Various D-Link DSL routers are susceptible to a remote authentication bypass vulnerability. This issue is due to a failure of the devices to require authentication in certain circumstances. This vulnerability allows remote attackers to gain...

Ricoh Aficio 450/455 PCL Printer - Remote ICMP Denial of Service

// source: https://www.securityfocus.com/bid/11932/info It is reported that Ricoh 450/455 printers are susceptible to a remote denial of service vulnerability. This issue is due to a failure of the device to properly handle exceptional ICMP packets. Remote attackers may exploit this vulnerability...

[SA13261] SecretSanta Security Bypass Vulnerability

TITLE: SecretSanta Security Bypass Vulnerability SECUNIA ADVISORY ID: SA13261 VERIFY ADVISORY: http://secunia.com/advisories/13261/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: SecretSanta 1.x http://secunia.com/product/4304/ DESCRIPTION: A vulnerability has been...

CVE-2002-0443

Microsoft Windows 2000 allows local users to bypass the policy that prohibits reusing old passwords by changing the current password before it expires, which does not enable the check for previous passwords...

CVE-2002-1336

TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users...

CVE-2004-0080

The login program in util-linux 2.11 and earlier uses a pointer after it has been freed and reallocated, which could cause login to leak sensitive data...

CVE-2003-0464

The RPC code in Linux kernel 2.4 sets the reuse flag when sockets are created, which could allow local users to bind to UDP ports that are used by privileged services such as nfsd...

DEBIAN-CVE-2002-1336

TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users...