OpenSAML XML Signature Wrapping Security Vulnerability

OpenSAML is prone to a security vulnerability involving XML signature wrapping. Successful exploits may allow unauthenticated attackers to construct specially crafted messages that can be successfully verified and contain arbitrary content. This may aid in further attacks. OpenVAS Vulnerability...

opensaml2 -- unauthenticated login

OpenSAML developer reports: The Shibboleth software relies on the OpenSAML libraries to perform verification of signed XML messages such as attribute queries or SAML assertions. Both the Java and C++ versions are vulnerable to a so-called "wrapping attack" that allows a remote, unauthenticated...

Update Protection against Novell iManager getMultiPartParameters Unauthorized File Upload

A vulnerability was reported in Novell iManager, a web-based administration console that provides management of many other Novell products. The vulnerability is due to insufficient validation of the getMultiPartParametersfunction. A remote attacker could leverage this vulnerability to upload...

Ruby on Rails 3.0.5 - WEBrick::HTTPRequest Module HTTP Header Injection

Ruby on Rails 3.0.5 - WEBrick::HTTPRequest Module HTTP Header Injection source: https://www.securityfocus.com/bid/46423/info Ruby on Rails is prone to a vulnerability that allows attackers to inject arbitrary content into the 'X-Forwarded-For', 'X-Forwarded-Host' and 'X-Forwarded-Server' HTTP...

PYSEC-2011-13

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

CVE-2011-0720

CVE-2011-0720 affects Plone 2.5–4.0 as used in Conga and luci. The vulnerability enables a remote attacker to obtain administrative access, read or create arbitrary content, and change the site skin via unspecified vectors due to improper access controls in the Conga/luci web components. Public a...

[SECURITY] [DSA-2141-1] New openssl packages fix protocol design flaw

------------------------------------------------------------------------ Debian Security Advisory DSA-2141-1 [email protected] http://www.debian.org/security/ Stefan Fritsch January 06, 2011 http://www.debian.org/security/faq -...

Mandriva Update for firefox MDVSA-2010:251-1 (firefox)

Check for the Version of firefox OpenVAS Vulnerability Test Mandriva Update for firefox MDVSA-2010:251-1 firefox Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Location bar SSL spoofing using network error page — Mozilla

Google security researcher Michal Zalewski reported that when a window was opened to a site resulting in a network or certificate error page, the opening site could access the document inside the opened window and inject arbitrary content. An attacker could use this bug to spoof the location bar...

Novell iManager getMultiPartParameters Unauthorized File Upload

Novell iManager is a web-based administration console that provides management of many other Novell products. The iManager service itself is a Java web application running on top of the Tomcat application container. An unauthorized file upload vulnerability has been reported in Novell iManager. T...

Ubuntu 9.04 : nspr update (USN-927-7)

USN-927-4 fixed vulnerabilities in NSS. This update provides the NSPR needed to use the new NSS. Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject...

Mozilla Firefox Address Bar Spoofing Vulnerability june-10 (Windows)

The host is installed with Mozilla Firefox and is prone to spoofing vulnerability. OpenVAS Vulnerability Test $Id: secpodmozillafirefoxspoofingvulnwinjun10.nasl 5394 2017-02-22 09:22:42Z teissa $ Mozilla Firefox Address Bar Spoofing Vulnerability june-10 Windows Authors: Antu Sanadi Copyright:...

Ubuntu Update for nss vulnerability USN-927-1

Ubuntu Update for Linux kernel vulnerabilities USN-927-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN9271.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for nss vulnerability USN-927-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.n...

Ubuntu 9.10 : nss vulnerability (USN-927-1)

Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user's session. This update adds support for the new new...

Ubuntu Update for openjdk-6 vulnerabilities USN-923-1

Ubuntu Update for Linux kernel vulnerabilities USN-923-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN9231.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for openjdk-6 vulnerabilities USN-923-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...

Apache Tomcat WAR Deployment Multiple Vulnerabilities

According to its self-reported version number, the remote host is running a version of Apache Tomcat that is affected by multiple vulnerabilities : - When deploying WAR files, the WAR files are not checked for directory traversal attempts which could allow an attacker to create arbitrary content...

CVE-2009-3375

content/html/document/src/nsHTMLDocument.cpp in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 allows user-assisted remote attackers to bypass the Same Origin Policy and read an arbitrary content selection via the document.getSelection function...

Mozilla Firefox 3.0.10 / SeaMonkey 1.1.16 - Address Bar URI Spoofing

source: https://www.securityfocus.com/bid/35388/info Mozilla Firefox and SeaMonkey are affected by a URI-spoofing vulnerability because they fail to adequately handle user-supplied data. An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting...

Frog CMS 0.9.4 Traversal / XSS

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Security Evaluation of Frog CMS Version tested: 0.9.4 by Justin C. Klein Keane This advisory is also posted at http://www.madirish.net/vulnerabilities/frog-cms Frog CMS http://www.madebyfrog.com/ is a lightweight content management system written in P...

DDIVRT-2009-21 vBook Login Application Cross-site Scripting Vulnerability

Title ----- DDIVRT-2009-21 vBook Login Application Cross-site Scripting Vulnerability Severity -------- Low Date Discovered --------------- January 19th, 2009 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: David Marshall and r@b13$ Vulnerability Description...