CVE-2014-3346

The web framework in Cisco Transport Gateway for Smart Call Home aka TG-SCH or Transport Gateway Installation Software does not validate an unspecified parameter, which allows remote authenticated users to cause a denial of service service crash via a crafted string, aka Bug ID CSCuq31819...

CVE-2014-3345

The web framework in Cisco Transport Gateway for Smart Call Home aka TG-SCH or Transport Gateway Installation Software 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503...

Authorization

The web framework in Cisco Transport Gateway for Smart Call Home aka TG-SCH or Transport Gateway Installation Software 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503...

CVE-2014-3345

The web framework in Cisco Transport Gateway for Smart Call Home aka TG-SCH or Transport Gateway Installation Software 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503...

CVE-2014-3345

Cisco Transport Gateway for Smart Call Home (TG-SCH) 4.0’s web framework fails to properly check authorization for administrative web pages, allowing remote attackers to modify the product via a crafted URL. Affected component: the web framework; root cause: improper authorization checks in admin...

Cisco Transport Gateway for Smart Call Home Unauthorized Configuration Change Vulnerability

A vulnerability in the web framework code of Cisco Transport Gateway for Smart Call Home TG-SCH could allow an unauthenticated, remote attacker to make certain changes to the system. The vulnerability is due to improper implementation of authorization controls when accessing certain administrativ...

CVE-2014-3344

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco Transport Gateway for Smart Call Home aka TG-SCH or Transport Gateway Installation Software 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq31129,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco Transport Gateway for Smart Call Home aka TG-SCH or Transport Gateway Installation Software 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq31129,...

CVE-2014-3344

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco Transport Gateway for Smart Call Home aka TG-SCH or Transport Gateway Installation Software 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq31129,...

CVE-2014-3344

CVE-2014-3344 affects Cisco Transport Gateway for Smart Call Home (TG-SCH) 4.0. Multiple cross-site scripting (XSS) flaws exist in the web framework, allowing remote attackers to inject arbitrary web scripts or HTML via unspecified parameters. Root cause cited: insufficient input validation in th...

Multiple Cross-Site Scripting Vulnerabilities in Transport Gateway for Smart Call Home

A vulnerability in the web framework of Cisco Transport Gateway for Smart Call Home TG-SCH could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input...

Tor Browser 3.6.4 and 4.0-alpha-1 are released

The Tor software protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, it prevents the sites you visit from learning your physical...

CentOS 6 / 7 : openssl (CESA-2014:1052)

Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

DEBIAN-CVE-2014-3511

The ssl23getclienthello function in s23srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol...

openssl: TLS protocol downgrade attack

A flaw was found in the way OpenSSL handled fragmented handshake packets. A man-in-the-middle attacker could use this flaw to force a TLS/SSL server using OpenSSL to use TLS 1.0, even if both the client and the server supported newer protocol versions...

openssl: DTLS packet processing double free

A flaw was discovered in the way OpenSSL handled DTLS packets. A remote attacker could use this flaw to cause a DTLS server or client using OpenSSL to crash or use excessive amounts of memory...

OpenJDK: Incorrect TLS/EC management (Security, 8031340)

Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect availability via unknown vectors related to Security...

bouncycastle: TLS CBC padding timing attack

It was discovered that bouncycastle leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle...

Automattic: Missing HSTS header in https://app.simplenote.com

Hi, Vulnerable Website: https://app.simplenote.com I tested the website using firefox add-on called: Strict Transport Security Detector https://addons.mozilla.org/en-US/firefox/addon/strict-transport-security-d/ HSTS addresses the following threats: User bookmarks or manually types...

Mandriva Linux Security Advisory : ffmpeg (MDVSA-2014:129)

Multiple vulnerabilities has been discovered and corrected in ffmpeg : Multiple unspecified vulnerabilities in libavcodec/wmalosslessdec.c in FFmpeg before 0.11 have unknown impact and attack vectors related to 1 size of mclms arrays, 2 a getbits0 in decodeacfilter, and 3 too many bits in...