Design/Logic Flaw

The extended ACL functionality in Cisco IOS 12.258SE2 and 15.01SE discards all lines that end with a log or time keyword, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by sending network traffic, aka Bug ID CSCts01106...

CVE-2012-0362

The extended ACL functionality in Cisco IOS 12.258SE2 and 15.01SE discards all lines that end with a log or time keyword, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by sending network traffic, aka Bug ID CSCts01106...

CVE-2011-4012

Cisco IOS 12.0, 15.0, and 15.1, when a Policy Feature Card 3C PFC3C is used, does not create a fragment entry during processing of an ICMPv6 ACL, which has unspecified impact and remote attack vectors, aka Bug ID CSCtj90091...

CVE-2012-0362

The CVE-2012-0362 issue affects Cisco IOS versions 12.2(58)SE2 and 15.0(1)SE, where the extended ACL processing discards all lines ending with a log or time keyword. This behavior can allow remote attackers to bypass intended access controls by sending network traffic, in opportunistic conditions...

CVE-2011-4012

Cisco IOS 12.0, 15.0, and 15.1 are affected when a Policy Feature Card 3C (PFC3C) is used. The vulnerability involves failure to create a fragment entry during processing of an ICMPv6 ACL, as described by Bug ID CSCtj90091. Reported impact is unspecified in the provided documents, and the vulnera...

PT-2012-1781

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.0, 15.0, and 15.1 Description The issue is related to the processing of an ICMPv6 ACL when a Policy Feature Card 3C PFC3C is used. It does not create a fragment entry, which has unspecified impact and can be exploited...

PT-2012-2521

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.258SE2 through 15.01SE Description The issue allows remote attackers to bypass intended access restrictions by sending network traffic. This occurs due to the extended ACL functionality discarding lines that end with...

CVE-2012-0362: Undefined Security Weakness

The extended ACL functionality in Cisco IOS 12.258SE2 and 15.01SE discards all lines that end with a log or time keyword, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by sending network traffic, aka Bug ID CSCts01106...

CVE-2011-4012: Undefined Security Weakness

Cisco IOS 12.0, 15.0, and 15.1, when a Policy Feature Card 3C PFC3C is used, does not create a fragment entry during processing of an ICMPv6 ACL, which has unspecified impact and remote attack vectors, aka Bug ID CSCtj90091...

CVE-2012-2213

Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and...

Design/Logic Flaw

DISPUTED Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable...

Cross site scripting

Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site 1 XMLHttpRequest or 2 WebSocket operation involvin...

CVE-2012-0475: Undefined Security Weakness

Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site 1 XMLHttpRequest or 2 WebSocket operation involvin...

CVE-2012-0475

Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site 1 XMLHttpRequest or 2 WebSocket operation involvin...

PT-2012-2596

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 11.0 Thunderbird versions 5.0 through 11.0 SeaMonkey versions prior to 2.9 Description The issue arises from the improper construction of the Origin and Sec-WebSocket-Origin HTTP headers, potentially allowi...

Design/Logic Flaw

VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via unspecified vectors...

CVE-2012-1518

VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via unspecified vectors...

CVE-2012-1518

The CVE-2012-1518 issue affects VMware products due to an incorrect ACL on the VMware Tools folder that could let a guest OS user escalate privileges. Affected products/versions include VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESX...

CVE-2012-1518: Undefined Security Weakness

VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via unspecified vectors...

VMware hosted products and ESXi/ESX patches address privilege escalation

a. VMware Tools Incorrect Folder Permissions Privilege EscalationThe access control list of the VMware Tools folder is incorrectly set. Exploitation of this issue may lead to local privilege escalation on Windows-based Guest Operating Systems.VMware would like to thank Tavis Ormandy for reporting...