PT-2014-1828

Name of the Vulnerable Software and Affected Versions cURL and libcurl versions 7.10.6 through 7.36.0 Description The default configuration in cURL and libcurl re-uses connections for various protocols, which might allow context-dependent attackers to connect as other users via a request. This...

Fedora Update for springframework-security FEDORA-2014-3811

Check for the Version of springframework-security OpenVAS Vulnerability Test Fedora Update for springframework-security FEDORA-2014-3811 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribut...

[SECURITY] Fedora 19 Update: springframework-security-3.1.6-1.fc19

Spring Security is a Java/Java EE framework that provides advanced authentication, authorization and other comprehensive security features for enterprise applications. In addition to having a comprehensive list of security functionality, Spring Security is very configurable and employs the Spring...

[SECURITY] Fedora 20 Update: springframework-security-3.1.6-1.fc20

Spring Security is a Java/Java EE framework that provides advanced authentication, authorization and other comprehensive security features for enterprise applications. In addition to having a comprehensive list of security functionality, Spring Security is very configurable and employs the Spring...

libssh -- PRNG state reuse on forking servers

Aris Adamantiadis reports: When accepting a new connection, the server forks and the child process handles the request. The RANDbytes function of openssl doesn't reset its state after the fork, but simply adds the current process id getpid to the PRNG state, which is not guaranteed to be unique...

Google Chrome释放后重用远程代码执行漏洞

BUGTRAQ ID: 65168 CVECAN ID: CVE-2013-6649 Google Chrome是由Google开发的一款Web浏览工具。 Chrome 32.0.1700.102之前版本使用的Blink core/rendering/svg/RenderSVGImage.cpp内函数RenderSVGImage::paint存在释放后重利用漏洞，可使远程攻击者通过零大小的SVG图形，造成拒绝服务或其他影响。 0 Google Chrome 32.0.1700.102 厂商补丁： Google ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载...

CVE-2014-0015

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request...

CVE-2014-0015

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request...

CVE-2014-0015: Improper Authentication

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request...

CURL-CVE-2014-0015 reuse of wrong HTTP NTLM connection

libcurl can in some circumstances reuse the wrong connection when asked to do an NTLM-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion...

reuse of wrong HTTP NTLM connection

libcurl can in some circumstances reuse the wrong connection when asked to do an NTLM-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion...

CVE-2013-5429

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager TFIM 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.2 before FP9 does not prevent reuse of One Time Password OTP tokens, which makes it easier for remote authenticated users to complet...

PT-2014-2925

Name of the Vulnerable Software and Affected Versions IBM Tivoli Federated Identity Manager versions 6.2.2 before FP9 IBM Tivoli Federated Identity Manager Business Gateway versions 6.2.2 before FP9 Description The issue concerns the Risk Based Access functionality, which fails to prevent the reu...

CVE-2013-5429: Improper Authentication

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager TFIM 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.2 before FP9 does not prevent reuse of One Time Password OTP tokens, which makes it easier for remote authenticated users to complet...

[security bulletin] HPSBPV02918 rev.2 - HP ProCurve Manager (PCM), HP PCM+ and HP Identity Driven Manager (IDM), SQL Injection, Remote Code Execution, Session Reuse

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03897409 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03897409 Version: 2 HPSBPV02918 rev....

PT-2013-4577

Name of the Vulnerable Software and Affected Versions SUSE Lifecycle Management Server SLMS versions prior to 1.3.7 Description The issue allows remote attackers to defeat intended cryptographic protection mechanisms by leveraging knowledge of a secret key from a product installation elsewhere, d...

emlog code reuse vulnerability, password blasting and other impact-vulnerability warning-the black bar safety net

Brief description: emlog code reuse. You can ignore the CAPTCHA brush comments, ignoring the code to brute force the background. Detailed description: See two days emlog source code is also not white to see it. In the comment when the service side validation of the data code as follows:...

JGroups: Authentication via cached credentials

The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information diagnostic information and execute arbitrary code by reusing valid credentials...

UBUNTU-CVE-2012-5627

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the changeuser command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks...

DEBIAN-CVE-2013-4112

The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information diagnostic information and execute arbitrary code by reusing valid credentials...