SocialEngine 4.2.2 - Multiple Vulnerabilities

Social Engine 4.2.2 Multiples Vulnerabilities Earlier versions are also possibly vulnerable. INFORMATION Product: Social Engine 4.2.2 Remote-Exploit: yes Vendor-URL: http://www.socialengine.net/ Discovered by: Tiago Natel de Moura aka "i4k" Discovered at: 10/04/2012 CVE Notified: 10/04/2012 CVE...

Mod_Auth_OpenID Session Stealing

https://github.com/paranoid/modauthopenid/blob/master/CVE-2012-2760.markdown Security Advisory 1201 Summary : Session stealing Date : May 2012 Affected versions : all versions prior to modauthopenid-0.7 ID : modauthopenid-1201 CVE reference : CVE-2012-2760 Details Session ids are stored insecurel...

Hardcoded credentials

The Xelex MobileTrack application 2.3.7 and earlier for Android uses hardcoded credentials, which allows remote attackers to obtain sensitive information via an unencrypted 1 FTP or 2 HTTP session...

PT-2012-4108

Name of the Vulnerable Software and Affected Versions Xelex MobileTrack versions 2.3.7 and earlier Description The issue allows remote attackers to obtain sensitive information via an unencrypted session, either through FTP or HTTP. This is possible due to the use of hardcoded credentials in the...

CVE-2012-2162

The Web Server Plug-in in IBM WebSphere Application Server WAS 8.0 and earlier uses unencrypted HTTP communication after expiration of the plugin-key.kdb password, which allows remote attackers to obtain sensitive information by sniffing the network, or spoof arbitrary servers via a...

Design/Logic Flaw

The Web Server Plug-in in IBM WebSphere Application Server WAS 8.0 and earlier uses unencrypted HTTP communication after expiration of the plugin-key.kdb password, which allows remote attackers to obtain sensitive information by sniffing the network, or spoof arbitrary servers via a...

PT-2012-3846

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 8.0 and earlier Description The issue allows remote attackers to obtain sensitive information by sniffing the network or spoof arbitrary servers via a man-in-the-middle attack due to the use of...

CVE-2012-2162: Undefined Security Weakness

The Web Server Plug-in in IBM WebSphere Application Server WAS 8.0 and earlier uses unencrypted HTTP communication after expiration of the plugin-key.kdb password, which allows remote attackers to obtain sensitive information by sniffing the network, or spoof arbitrary servers via a...

CVE-2012-0726

The default configuration of TLS in IBM Tivoli Directory Server TDS 6.3 and earlier supports the 1 NULL-MD5 and 2 NULL-SHA ciphers, which allows remote attackers to trigger unencrypted communication via the TLS Handshake Protocol...

Default configuration

The default configuration of TLS in IBM Tivoli Directory Server TDS 6.3 and earlier supports the 1 NULL-MD5 and 2 NULL-SHA ciphers, which allows remote attackers to trigger unencrypted communication via the TLS Handshake Protocol...

PT-2012-2818

Name of the Vulnerable Software and Affected Versions IBM Tivoli Directory Server versions 6.3 and earlier Description The default configuration of TLS in the software supports the NULL-MD5 and NULL-SHA ciphers, allowing remote attackers to trigger unencrypted communication via the TLS Handshake...

CVE-2012-0726: Undefined Security Weakness

The default configuration of TLS in IBM Tivoli Directory Server TDS 6.3 and earlier supports the 1 NULL-MD5 and 2 NULL-SHA ciphers, which allows remote attackers to trigger unencrypted communication via the TLS Handshake Protocol...

Facebook Reassures Users, But Hole May Put Mobile Data at Risk

UPDATED: Facebook Security assured users on Thursday who access their Facebook account via Android or iOS devices that mobile sessions on the social networking site aren’t vulnerable to hacking. However, research published this week suggests otherwise. A blog entry posted by UK-based mobile...

Tapes Containing Information On 800K Lost From California Child Support Agency

Backup cartridges containing records on 800,000 individuals belonging to the California Department of Child Support Services DCCS were lost in transit between an IBM facility in Colorado and DCCS’s headquarters in California On March 12, according to a statement from DCCS. PDF The records in...

[SECURITY] Fedora 17 Update: krb5-1.10-4.fc17

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form...

initscripts: IPSec ifup script allows for aggressive IKE mode

The default IPSec ifup script in Red Hat Enterprise Linux 3 through 5 configures racoon to use aggressive IKE mode instead of main IKE mode, which makes it easier for remote attackers to conduct brute force attacks by sniffing an unencrypted preshared key PSK hash...

CVE-2011-3444

Address Book in Apple Mac OS X before 10.7.3 automatically switches to unencrypted sessions upon failure of encrypted connections, which allows remote attackers to read CardDAV data by terminating an encrypted connection and then sniffing the network...

FreeBSD : FreeBSD -- pam_ssh improperly grants access when user account has unencrypted SSH private keys (eda151d8-4638-11e1-9f47-00e0815b8da8)

The OpenSSL library call used to decrypt private keys ignores the passphrase argument if the key is not encrypted. Because the pamssh module only checks whether the passphrase provided by the user is null, users with unencrypted SSH private keys may successfully authenticate themselves by providi...

FreeBSD Security Advisory FreeBSD-SA-11:09.pam_ssh

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-11:09.pamssh Security Advisory The FreeBSD Project Topic: pamssh improperly grants access when user account has unencrypted SSH private keys Category: contrib...

SEC Consult SA-20111219-1 :: Multiple vulnerabilities in WhatsApp

SEC Consult Vulnerability Lab Security Advisory 20111219-1 ======================================================================= title: Multiple vulnerabilities in WhatsApp product: WhatsApp tested on Android client fixed version: - impact: Medium homepage: http://www.whatsapp.com/ found:...