CVE-2009-3245

CVE-2009-3245 affects OpenSSL up to 0.9.8m, where bn_wexpand() may not check a NULL return value in bn_div.c, bn_gf2m.c, ec2_smpl.c, and e_ubsec.c. Impact is described as unspecified/context-dependent, with exploit details not provided in the cited sources. Several vendor advisories (e.g., CentOS...

CVE-2009-3245

OpenSSL before 0.9.8m does not check for a NULL return value from bnwexpand function calls in 1 crypto/bn/bndiv.c, 2 crypto/bn/bngf2m.c, 3 crypto/ec/ec2smpl.c, and 4 engines/eubsec.c, which has unspecified impact and context-dependent attack vectors...

Microsoft to Patch 8 Vulnerabilities in Windows, Office

Microsoft has announced plans to ship two security bulletins next week to fix a total of eight vulnerabilities affecting Windows and Office products. Both bulletins are rated “important” because of the risk compromising the confidentiality, integrity or availability of user data. Microsoft is...

CVE-2010-0918

Multiple unspecified vulnerabilities in the UltraLite functionality in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 have unknown impact and attack vectors...

CVE-2010-0918

Technical details for CVE-2010-0918 are not publicly available in the provided documents. The records describe unspecified vulnerabilities with unknown impact and vectors. Monitor for updates from vendors and threat feeds.

PYSEC-2010-2

MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors...

Default configuration

The default configuration of cfg.packagepagesactionsexcluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors...

CVE-2010-0669

Removed by vendor...

CVE-2010-0717

Removed by vendor...

CVE-2010-0669

MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors...

UBUNTU-CVE-2010-0286

Unspecified vulnerability in the OpenID Identity Authentication extension in TYPO3 4.3.0 allows remote attackers to bypass authentication and gain access to a backend user account via unknown attack vectors in which both the attacker and victim have an OpenID provider that discards identities...

CVE-2010-0634

Unspecified vulnerability in Fast Lexical Analyzer Generator flex before 2.5.35 has unknown impact and attack vectors...

CVE-2010-0634

Unspecified vulnerability in Fast Lexical Analyzer Generator flex before 2.5.35 has unknown impact and attack vectors...

CVE-2010-0634

Unspecified vulnerability in Fast Lexical Analyzer Generator flex before 2.5.35 has unknown impact and attack vectors...

CVE-2010-0612

Unspecified vulnerability in DocumentManager before 4.0 has unknown impact and attack vectors, related to file rights...

Design/Logic Flaw

Unspecified vulnerability in DocumentManager before 4.0 has unknown impact and attack vectors, related to file rights...

CVE-2010-0612

Unspecified vulnerability in DocumentManager before 4.0 has unknown impact and attack vectors, related to file rights...

CVE-2009-2751

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...

CVE-2009-2751

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...

Lessons Learned From the Aurora Attacks

It’s been more than two weeks now since the cyber-end of the cyber-world caused by the cyber-attacks on the cyber-networks of Google, Adobe and several other high tech companies, and amid all of the noise and hand-wringing there has been precious little in the way of cool, logical analysis of wha...