4586 matches found
Debian: Security Advisory (DSA-2541-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-2541-1 : beaker - information disclosure
It was discovered that Beaker, a cache and session library for Python, when using the python-crypto backend, is vulnerable to information disclosure due to a cryptographic weakness related to the use of the AES cipher in ECB mode. Systems that have the python-pycryptopp package should not be...
[SECURITY] [DSA 2541-1] beaker security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2541-1 [email protected] http://www.debian.org/security/ Raphael Geissert September 07, 2012 http://www.debian.org/security/faq -...
DSA-2541-1 beaker - information disclosure
Bulletin has no description...
Kayako Fusion 4.40.1148 Cross Site Scripting
Advisory ID: HTB23095 Product: Kayako Fusion Vendor: Kayako Vulnerable Versions: 4.40.1148 and probably prior Tested Version: 4.40.1148 Vendor Notification: June 6, 2012 Public Disclosure: September 5, 2012 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: CVE-2012-3233 CVSSv2 Base...
TestLink 1.9.3 Cross Site Request Forgery Vulnerability
Exploit for php platform in category web applications Product: TestLink Vendor: teamst.org Vulnerable Versions: 1.9.3 and probably prior Tested Version: 1.9.3 Vendor Notification: April 18, 2012 Public Disclosure: September 5, 2012 Vulnerability Type: Cross-Site Request Forgery CWE-352 CVE...
Fixed in Apache Tomcat 7.0.30
Important: Denial of service CVE-2012-3544 When processing a request submitted using the chunked transfer encoding, Tomcat ignored but did not limit any extensions that were included. This allows a client to perform a limited DOS by streaming an unlimited amount of data to the server. This was...
New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions
There is a feature supported by the SSL/TLS encryption standard and used by most of the major browsers that leaks enough information about encrypted sessions to enable attackers decrypt users’ supposedly protected cookies and hijack their sessions. The researchers who developed the attack that...
Plug-in content may monitor keystrokes on unrelated pages
Plug-ins may use operating system features to detect key presses when the plug-in is focused. If the plug-in does not detect its own focused state correctly, it can detect key presses when other pages are focused, allowing the plug-in content to detect key presses intended for pages from other...
Scientific Linux Security Update : mcstrans on SL5.x i386/x86_64
An algorithmic complexity weakness was found in the way the mcstrans daemon handled ranges of compartments in sensitivity labels. A local user could trigger this flaw causing mctransd to temporarily stop responding to other requests; a partial denial of service. CVE-2007-4570 This update also fix...
CVE-2012-3886
AirDroid 1.0.4 beta uses the MD5 algorithm for values in the checklogin key parameter and 7bb cookie, which makes it easier for remote attackers to obtain cleartext data by sniffing the local wireless network and then conducting a 1 brute-force attack or 2 rainbow-table attack...
CVE-2012-2808 : Android 4.0.4 DNS poisoning vulnerability Exposed
Android's DNS resolver is vulnerable to DNS poisoning due to weak randomness in its implementation. Researchers Roee Hay & Roi Saltzman from IBM Application Security Research Group demonstrate that how an attacker can successfully guess the nonce of the DNS request with a probability thatis su...
PT-2012-2871 · Moodle · Moodle
Name of the Vulnerable Software and Affected Versions: Moodle versions 1.9.x through 1.9.15 Moodle versions 2.0.x through 2.0.6 Moodle versions 2.1.x through 2.1.3 Moodle versions 2.2.x through 2.2.0 Description: The issue concerns the use of a hardcoded password in the rc4encrypt function, makin...
Oracle Database TNS Listener Service Registration Authentication Weakness (CVE-2012-1675)
An authentication weakness vulnerability has been reported in Oracle Database's TNS listener component...
CVE-2012-2742
The vulnerability (CVE-2012-2742) affects Revelation password manager, specifically versions 0.4.13-2 and earlier. The root cause is that the software uses only the first 32 characters of a password and then pads with zeros, reducing entropy. This can make context-dependent brute-force attacks mo...
RHEL 5 / 6 : postgresql and postgresql84 (RHSA-2012:1037)
The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1037 advisory. - BSD crypt: DES encrypted password weakness CVE-2012-2143 - postgresql: Ability of database owners to install procedural languages via...
crypt(): DES encrypted password weakness
The cryptdes aka DES-based crypt function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an...
PHP 5.4.x < 5.4.4 Multiple Vulnerabilities
According to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.4, and as such is potentially affected the following vulnerabilities : - An integer overflow error exists in the function 'pharparsetarfile' in the file 'ext/phar/tar.c'. This error can lead to a...
rack-cache Rubygem Sensitive HTTP Header Caching Weakness
Rack::Cache rack-cache contains a flaw related to the rubygem caching sensitive HTTP headers. This will result in a weakness that may make it easier for an attacker to gain access to a user's session via a specially crafted header...
