Design/Logic Flaw

The Certificate Authority Proxy Function CAPF service in Cisco Unified Communications Manager CUCM 4.1 before 4.13SR7, 4.2 before 4.23SR4, and 4.3 before 4.32 allows remote attackers to cause a denial of service service crash via malformed network traffic, aka Bug ID CSCsk46770...

CVE-2008-1744

The Certificate Authority Proxy Function CAPF service in Cisco Unified Communications Manager CUCM 4.1 before 4.13SR7, 4.2 before 4.23SR4, and 4.3 before 4.32 allows remote attackers to cause a denial of service service crash via malformed network traffic, aka Bug ID CSCsk46770...

CVE-2008-1744

The Certificate Authority Proxy Function CAPF service in Cisco Unified Communications Manager CUCM 4.1 before 4.13SR7, 4.2 before 4.23SR4, and 4.3 before 4.32 allows remote attackers to cause a denial of service service crash via malformed network traffic, aka Bug ID CSCsk46770...

Design/Logic Flaw

Apple Safari 3.1.1 allows remote attackers to spoof the address bar by placing many "invisible" characters in the userinfo subcomponent of the authority component of the URL aka the user field, as demonstrated by %E3%80%80 sequences...

ssl-cert eclass: Certificate disclosure

Background The ssl-cert eclass is a code module used by Gentoo ebuilds to generate SSL certificates. Description Robin Johnson reported that the docert function provided by ssl-cert.eclass can be called by source building stages of an ebuild, such as srccompile or srcinstall, which will result in...

Cross site request forgery (csrf)

Unspecified vulnerability in Local Security Authority Subsystem Service LSASS in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows local users to gain privileges via a crafted local procedure call LPC request...

CVE-2006-2939

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none...

CVE-2007-5499

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none...

Firefox / Konqueror / Safari certificate spoofing

Link between certificate and web site is not set, if certificate from unknown certification authirity is manually approved, making it's possible to use same certificate for different site withour warning...

CVE-2002-2414

Opera 6.0.3, when using Squid 2.4 for HTTPS proxying, does not properly handle when accepting a non-global certificate authority CA certificate from a site and establishing a subsequent HTTPS connection, which allows remote attackers to cause a denial of service crash...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in 1 Request-spk.xuda and 2 Add-msie-request.xuda in RSA KEON Registration Authority Web Interface 1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-5703

Multiple cross-site scripting XSS vulnerabilities in 1 Request-spk.xuda and 2 Add-msie-request.xuda in RSA KEON Registration Authority Web Interface 1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-5703

CVE-2007-5703 concerns multiple cross-site scripting (XSS) vulnerabilities in the RSA KEON Registration Authority Web Interface 1.0, specifically in (1) Request-spk.xuda and (2) Add-msie-request.xuda. Remote attackers could inject arbitrary web script or HTML via unspecified vectors. Public sourc...

CVE-2007-5703

Multiple cross-site scripting XSS vulnerabilities in 1 Request-spk.xuda and 2 Add-msie-request.xuda in RSA KEON Registration Authority Web Interface 1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Input validation

Incomplete blacklist vulnerability in the Certificate Authority CA in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information passwords when an administrator enters a "ca activate" or "ca unlock" command with any uppercase character,...

[GS07-02] RSA Keon Multiple Cross-Site Scripting Vulnerabilities

GS07-02 RSA Keon Multiple Cross-Site Scripting Vulnerabilities Date & Version : 07/31/2007 - 1.0 Description : RSA KEON Registration Authority Web Interface has multiple Cross-Site Scripting Vulnerabilities. Request-spk.xuda and Add-msie-request.xuda components of RSA KEON are vulnerable to...

Microworld eScan (Multiple Products) - Local Privilege Escalation

Microworld eScan Multiple Products - Local Privilege Escalation source: https://www.securityfocus.com/bid/25493/info Multiple MicroWorld eScan products are vulnerable to a local privilege-escalation vulnerability because of insecure default file permissions. Attackers can exploit this issue to...

Microworld eScan (Multiple Products) - Local Privilege Escalation

source: https://www.securityfocus.com/bid/25493/info Multiple MicroWorld eScan products are vulnerable to a local privilege-escalation vulnerability because of insecure default file permissions. Attackers can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful...

Windows平台的Cisco VPN客户端多个本地权限提升漏洞

BUGTRAQ ID: 25332 Cisco VPN客户端允许用户创建到支持Cisco VPN设备的IPSec VPN隧道。 Microsoft Windows的Cisco VPN客户端中存在两个漏洞，允许本地非特权用户提升权限。 1. 通过Microsoft Windows拨号网络接口的本地权限提升 非特权用户可以通过启用Start Before Logon（SBL）功能并配置VPN配置使用Microsoft拨号网络接口将权限提升到LocalSystem帐号用户的权限。如果同时启用并配置了这两个设置，就可以在Windows登录窗口中使用Cisco...

[Full-disclosure] Windows Oday release

dear all SChannel Off-By-One Heap Corruption =================================== Discovery Date: 28th August 2006 Date reported to Microsoft: 19th March 2007 Summary: The Secure Channel SChannel library on WinXP-SP1/SP2 is vulnerable to a off-by-one heap buffer overwrite. The SChannel library...