180 matches found
CVE-2014-2956
CVE-2014-2956 affects AVG Secure Search toolbar (before 18.1.7.598) and AVG Safeguard (before 18.1.7.644). The ScriptHelperApi ActiveX control does not enforce domain-based access control for its methods, enabling remote attackers to trigger downloading/execution of arbitrary code via a crafted w...
SuSE 11.3 Security Update : curl (SAT Patch Number 9133)
This curl update fixes the following security issues : - wrong re-use of connections. CVE-2014-0138. bnc868627 - IP address wildcard certificate validation. CVE-2014-0139. bnc868629 - --insecure option inappropriately enforcing security safeguard. bnc870444 %NASLMINLEVEL 70300 C Tenable Network...
WordPress iMember360is 3.9.001 XSS / Disclosure / Code Execution
WordPress iMember360is plugin versions 3.8.012 through 3.9.001 suffers from arbitrary code execution, database credential disclosure, arbitrary user deletion, and cross site scripting vulnerabilities. ------------ BACKGROUND ------------ "iMember360is a WordPress plugin that will turn a normal...
Sophos Safeguard Enterprise本地安全限制绕过漏洞(CVE-2012-4736)
BUGTRAQ ID: 59311 CVECAN ID: CVE-2012-4736 Sophos Safeguard Enterprise是磁盘加密解决方案。 SafeGuard Enterprise 6.0 及其他版本内的Device Encryption Client组件存在安全漏洞，该漏洞源于启用基于卷的加密策略并使用用户定义的密钥时，组件没有正确地阻止使用exFAT USB闪存盘，本地用户可利用此漏洞通过多次removal和reattach操作，绕过目标访问限制并复制敏感信息到设备。 0 Sophos Safeguard Enterprise 厂商补丁： Sophos ----...
CVE-2010-5249
Untrusted search path vulnerability in Sophos Free Encryption 2.40.1.1 and Sophos SafeGuard PrivateCrypto 2.40.1.2 allows local users to gain privileges via a Trojan horse pcrypt0406.dll file in the current working directory, as demonstrated by a directory that contains a .uti file. NOTE: the...
Design/Logic Flaw
Untrusted search path vulnerability in Sophos Free Encryption 2.40.1.1 and Sophos SafeGuard PrivateCrypto 2.40.1.2 allows local users to gain privileges via a Trojan horse pcrypt0406.dll file in the current working directory, as demonstrated by a directory that contains a .uti file. NOTE: the...
CVE-2010-5249
Untrusted search path vulnerability in Sophos Free Encryption 2.40.1.1 and Sophos SafeGuard PrivateCrypto 2.40.1.2 allows local users to gain privileges via a Trojan horse pcrypt0406.dll file in the current working directory, as demonstrated by a directory that contains a .uti file. NOTE: the...
CVE-2010-5249
The CVE-2010-5249 entry concerns an untrusted search path vulnerability in Sophos Free Encryption 2.40.1.1 and Sophos SafeGuard PrivateCrypto 2.40.1.2. The flaw lets local users gain privileges by placing a malicious pcrypt0406.dll in the current working directory, demonstrated via a directory co...
CVE-2012-4736
The Device Encryption Client component in Sophos SafeGuard Enterprise 6.0, when a volume-based encryption policy is enabled in conjunction with a user-defined key, does not properly block use of exFAT USB flash drives, which makes it easier for local users to bypass intended access restrictions a...
Design/Logic Flaw
The Device Encryption Client component in Sophos SafeGuard Enterprise 6.0, when a volume-based encryption policy is enabled in conjunction with a user-defined key, does not properly block use of exFAT USB flash drives, which makes it easier for local users to bypass intended access restrictions a...
CVE-2012-4736
CVE-2012-4736 affects Sophos SafeGuard Enterprise 6.0: Device Encryption Client fails to block exFAT USB drives when a volume-based policy is enabled with a user-defined key, enabling local users to copy data by removing/reattaching drives. Root cause: improper enforcement of encryption policy fo...
CVE-2012-4736
The Device Encryption Client component in Sophos SafeGuard Enterprise 6.0, when a volume-based encryption policy is enabled in conjunction with a user-defined key, does not properly block use of exFAT USB flash drives, which makes it easier for local users to bypass intended access restrictions a...
CVE-2011-5117
Sophos SafeGuard Enterprise Device Encryption 5.x through 5.50.8.13, Sophos SafeGuard Easy Device Encryption Client 5.50.x, and Sophos Disk Encryption 5.50.x have a delay before removal of 1 out-of-date credentials and 2 invalid credentials, which allows physically proximate attackers to defeat t...
Code injection
Sophos SafeGuard Enterprise Device Encryption 5.x through 5.50.8.13, Sophos SafeGuard Easy Device Encryption Client 5.50.x, and Sophos Disk Encryption 5.50.x have a delay before removal of 1 out-of-date credentials and 2 invalid credentials, which allows physically proximate attackers to defeat t...
CVE-2011-5117
Sophos SafeGuard Enterprise Device Encryption 5.x–5.50.8.13, Sophos SafeGuard Easy Device Encryption Client 5.50.x, and Sophos Disk Encryption 5.50.x are affected by a delay in removing (1) out‑of‑date credentials and (2) invalid credentials. This timing gap lets a physically proximate attacker d...
SafeGuard PrivateDisk 2.02.3 - privatediskm.sys Multiple Local Security Bypass Vulnerabilities
SafeGuard PrivateDisk 2.02.3 - privatediskm.sys Multiple Local Security Bypass Vulnerabilities // source: https://www.securityfocus.com/bid/45749/info SafeGuard PrivateDisk is prone to multiple local security-bypass vulnerabilities. Attackers with physical access to a computer with the affected...
SafeGuard PrivateDisk 2.0/2.3 - 'privatediskm.sys' Multiple Local Security Bypass Vulnerabilities
// source: https://www.securityfocus.com/bid/45749/info SafeGuard PrivateDisk is prone to multiple local security-bypass vulnerabilities. Attackers with physical access to a computer with the affected application installed can exploit these issues to bypass certain security restrictions and perfo...
CVE-2006-7142
The centralized management feature for Utimaco Safeguard stores hard-coded cryptographic keys in executable programs for encrypted configuration files, which allows attackers to recover the keys from the configuration files and decrypt the disk drive...
CVE-2006-7142
The CVE-2006-7142 entry concerns Utimaco Safeguard’s centralized management feature, which stores hard-coded cryptographic keys inside executable binaries for encrypted configuration files. The underlying issue is hard-coded keys that can be extracted from the configuration files, enabling attack...