Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores,...

RedHat Update for cyrus-imapd RHSA-2011:0859-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Design/Logic Flaw

IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

CVE-2011-0279

HP Multifunction Peripheral MFP Digital Sending Software DSS 4.91.00 does not properly configure authentication settings of managed devices within device templates, which allows attackers to access these devices via actions that were intended to require authentication...

CVE-2010-1324

MIT Kerberos 5 aka krb5 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via 1 an unkeyed checksum, 2 an unkeyed PAC checksum, or 3 a KrbFastArmoredRe...

CVE-2010-3868

Red Hat Certificate System RHCS 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authorit...

Code injection

programs/pluto/xauth.c in the client in Openswan 2.6.26 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in the ciscobanner aka serverbanner field, a different vulnerability than CVE-2010-3308...

Memory corruption

Unspecified vulnerability in Microsoft IIS 6.0, 7.0, and 7.5, when Extended Protection for Authentication is enabled, allows remote authenticated users to execute arbitrary code via unknown vectors related to "token checking" that trigger memory corruption, aka "IIS Authentication Memory Corrupti...

CVE-2010-1222

CA XOsoft r12.5 does not properly perform authentication, which allows remote attackers to obtain potentially sensitive information via a SOAP request...

CVE-2009-2936

The Command Line Interface aka Server CLI or administration interface in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to 1 execute arbitrary code via a vcl.inline...

ewebeditor for php&asp version of the backend skips the authentication vulnerability-vulnerability warning-the black bar safety net

Affected versions:php v3. 8,asp v2. 8 eWebEditor is a WYSIWYG online editor. As the name suggests, is on the network using the WYSIWYG edit mode for editing illustrated articles, news, discussions stickers, circulars, notes and other word processing applications. ../ewebeditor/admin/config. php...

[ MDVSA-2009:333 ] postgresql

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:333 http://www.mandriva.com/security/ Package : postgresql Date : December 15, 2009 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 3.0, Corporate 4.0, Enterprise Server 5.0 Problem Description: Multiple...

CVE-2009-3027

VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Protection Server CPS 11d, 12.0, and 12.5; Veritas NetBackup Operations Manager NOM 6.0 GA through 6.5.5; Veritas Backup Reporter VBR 6.0 GA through 6.6; Veritas Storage Foundation SF 3.5; Veritas Storage Foundation for Windows High...

CVE-2009-4128

GNU GRand Unified Bootloader GRUB 2 1.97 only compares the submitted portion of a password with the actual password, which makes it easier for physically proximate attackers to conduct brute force attacks and bypass authentication by submitting a password whose length is 1...

CVE-2008-6911

SQL injection vulnerability in the authenticateUser function in includes/authentication.inc.php in BrewBlogger BB 2.1.0.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the loginUsername parameter to includes/logincheck.inc.php. NOTE: some of these...

CVE-2009-0580

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /jsecuritycheck with malformed URL encoding of passwords, related to improper error checking in the 1...

Precidia Ether232 multiple security vulnerabilities

Built-in web server memory corruption andauthentication bypass...

CVE-2008-5576

admin/forums.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to bypass authentication and gain administrative access via a large value of the currentuseruserslevel parameter...

DataWizard FTPXQ Default Accounts

The remote FTP server has one or more default test accounts. Description : The version of DataWizard FTPXQ that is installed on the remote host has one or more default accounts setup which can allow an attacker to read and/or write arbitrary files on the system. OpenVAS Vulnerability Test $Id:...

EUVD-2008-3495

LoveCMS 1.6.2 does not require administrative authentication for 1 addblock.php, 2 blocks.php, and 3 themes.php in system/admin/, which allows remote attackers to change the configuration or execute arbitrary PHP code via addition of blocks, and other vectors...