Open redirect

OXUpdater in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof update servers and install arbitrary software via a crafted certificate...

Amazon Linux AMI : perl-libwww-perl (ALAS-2011-17)

The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...

Moderate: Red Hat Security Advisory: python-glanceclient security update

An updated python-glanceclient package that fixes one security issue is now available for Red Hat OpenStack 3.0. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2012-6606

The CVE-2012-6606 issue affects Palo Alto Networks GlobalProtect (before 1.1.7) and NetConnect, where the client fails to validate X.509 certificates from SSL servers. The root cause is certificate validation being skipped, enabling an attacker to perform a man-in-the-middle attack and potentiall...

CVE-2013-1909

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2013-4699

The Yahoo! Japan Yafuoku! application 4.3.0 and earlier for iOS and Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

SuSE 11.2 / 11.3 Security Update : telepathy-idle (SAT Patch Numbers 8215 / 8216)

Telepathy-idle did not check SSL certificates. CVE-2007-6746 was assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc...

Scanning the Internet in 45 Minutes

The Internet is a big thing. Or, more accurately, a big collection of things. Figuring out exactly how many things, and what vulnerabilities those things contain has always been a challenge for researchers, but a new tool released by a group from the University of Michigan that is capable of...

Microsoft discontinues MD5 crypto for digital certificates to improve RDP Authentication

This week Microsoft has released several advisories to help their users update from weak crypto. Microsoft is beginning the process of discontinuing support for digital certificates that use the MD5 hashing algorithm and to improve the network-level authentication for the Remote Desktop Protocol...

Google Swapping 1024-bit Keys for 2048-bit Keys

Google announced this week that it has begun upgrading its SSL certificates from 1024-bit keys to 2048-bit keys, a move that should help add an extra layer of security for anyone who uses the search giant’s services. According to a post on Google’s Developers blog by Identity Team member Tim Bray...

[SECURITY] Fedora 17 Update: curl-7.24.0-10.fc17

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

[OWASP Zed Attack Proxy 2.1.0] An easy to use integrated penetration testing tool for finding vulnerabilities in web applications

The OWASP Zed Attack Proxy ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration...

[SECURITY] Fedora 18 Update: curl-7.27.0-11.fc18

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Oracle Linux 4 : pidgin (ELSA-2008-1023)

From Red Hat Security Advisory 2008:1023 : Updated Pidgin packages that fix several security issues and bugs are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Pidgin is a multi-protocol...

Oracle Linux 6 : rsyslog (ELSA-2012-0796)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-0796 advisory. 5.8.10-2 - add patch to update information on debugging in the man page Resolves: 820311 - add patch to prevent debug output to stdout after forking Resolves:...

Facebook implementing Advanced HTTPS to minimize NSA Interception

For years the National Security Agency has successfully shielded its surveillance programs from any real public scrutiny. There have been a lot of news stories about NSA surveillance programs following the leaks of secret documents by Edward Snowden. We have learned that the NSA is collecting...

CVE-2013-4669

FortiClient before 4.3.5.472 on Windows, before 4.0.3.134 on Mac OS X, and before 4.0 on Android; FortiClient Lite before 4.3.4.461 on Windows; FortiClient Lite 2.0 through 2.0.0223 on Android; and FortiClient SSL VPN before 4.0.2258 on Linux proceed with an SSL session after determining that the...

CVE-2013-2319

FileMaker Pro before 12 and Pro Advanced before 12 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Apple iTunes Multiple Vulnerabilities - June13 (Windows)

This host is installed with Apple iTunes and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbappleitunesmultvulnjun13win.nasl 8169 2017-12-19 08:42:31Z cfischer $ Apple iTunes Multiple Vulnerabilities - June13 Windows Authors: Thanga Prakash S Copyright: Copyright c 2013...

Apple iTunes Multiple Vulnerabilities - June13 (Mac OS X)

This host is installed with Apple iTunes and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbappleitunesmultvulnjun13macosx.nasl 6104 2017-05-11 09:03:48Z teissa $ Apple iTunes Multiple Vulnerabilities - June13 Mac OS X Authors: Thanga Prakash S Copyright: Copyright c 2013...