CVE-2014-8124

OpenStack Dashboard Horizon before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page...

HackerOne: homograph attack. IDNs displayed in unicode in bug reports and on external link warning page

the IDN: http://ebаy.com/ is a homograph for the latin ebay.com. if you click that first link, youm might think that you are going to ebay.com. in fact, you are going to a homograph url http://xn--eby-7cd.com/ more info http://www.chromium.org/developers/design-documents/idn-in-google-chrome more...

IPSwitch IMail Server <= 8.1 - Local Password Decryption Utility

No description provided by source. / IpSwitch IMail Server = ver 8.1 User Password Decryption by Adik netmaniac hotmail KG IpSwitch IMail Server uses weak encryption algorithm to encrypt its user passwords. It uses polyalphabetic Vegenere cipher to encrypt its user passwords. This encryption sche...

openSUSE Security Update : privoxy (openSUSE-2013-242)

privoxy was updated to 3.0.21 stable fo fix CVE-2013-2503 bnc809123 - changes in 3.0.21 - On POSIX-like platforms, network sockets with file descriptor values above FDSETSIZE are properly rejected. Previously they could cause memory corruption in configurations that allowed the limit to be reache...

HackerOne: Control Characters Not Stripped From Username on Signup

Hey, To be honest, I'm not sure if there is any real security implications of this bug, but it's IMO something which should be fixed at some point since it'll be pretty easy. On signup, the username you chose has to be alphanumeric. If you submit someone else's username, followed by a null-byte...

Fedora 19 : systemd-204-15.fc19 (2013-17119)

Fixes polkit authentication issue. Updates the hardware database including keyboard mappings to the latest version from upstream. Backport a bunch of fixes from upstream. Only a few correspond to bug reports, and others correct display issues, memory access, and correctness of operation. Note tha...

Cisco Hosted Collaboration Mediation Excessive CPU Utilization Vulnerability

A vulnerability in the network stack of Cisco Hosted Collaboration Mediation could allow an unauthenticated, remote attacker to cause excessive CPU utilization on the affected system. The vulnerability is due to insufficient optimization of resources when the affected system is flooded with...

Cisco Prime Infrastructure Rogue AP SSID Cross-Site Scripting Vulnerability

A vulnerability in the wireless configuration module of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to insert scripts into the listing of rogue access points. The vulnerability is due to a failure to properly sanitize SSIDs before inserting them into the XML windowi...

Cisco Nexus 1000V VSM/VEM Communication Encryption Bypass Vulnerability

Cryptographic issues in the Cisco Nexus 1000v could allow an unauthenticated, remote attacker to to inject traffic or eavesdrop on the communications between a Virtual Supervisor Module VSM and a Virtual Ethernet Module VEM. The issues are due to errors in the implementation of the cryptography...

Cisco Nexus 1000V VSM to vCenter Communication Man-in-the-Middle Vulnerability

A vulnerability in the SSL implementation of the Cisco Nexus 1000V could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against Virtual Supervisor Module VSM to VMware vCenter communications. The vulnerability is due to improper verification of SSL security...

Cisco Nexus 1000V Insufficient VSM/VEM Authentication Vulnerability

A vulnerability in the Cisco Nexus 1000V could allow an unauthenticated, remote attacker to obtain control over a Virtual Ethernet Module VEM and associated port groups. The vulnerability is due to insufficient authentication between a VEM and a Virtual Supervisor Module VSM. An attacker could...

Cisco Secure Access Control System Session Fixation Web Vulnerability

A vulnerability in the web interface of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to acquire the session identifier of another user's session. The vulnerability is due to the lack of session identifier regeneration. An attacker could exploit this...

Cisco ACE Log Retention Denial of Service Vulnerability

A vulnerability in the SSL logging daemon of Cisco Application Control Engine ACE could allow an unauthenticated, remote attacker to cause a denial of service condition on the affected device. The vulnerability occurs because the Cisco ACE fails to rotate logs from SSL sessions, exhausting the ha...

Cisco ISM Malformed Authentication Header Packet Denial of Service Vulnerability

A vulnerability in authentication header packets processing on the Cisco ISM module for ISR G2 could allow an authenticated, remote attacker to cause a reload of the affected module. The vulnerability is due to improper processing of malformed authentication header packets. An attacker could...

Cisco TelePresence Management Suite SNMP Denial of Service Vulnerability

A vulnerability in the 64-bit SNMP server of Cisco TelePresence Management Suite TMS could allow an unauthenticated, remote attacker to terminate the TMSSNMPService.exe process. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending SNMP tra...

CVE-2013-0253

The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle MITM attack...

Cisco Connected Grid Network Management System SQL Injection Vulnerabilities

A vulnerability in device management of the Cisco Connected Grid Network Management System CG-NMS could allow an unauthenticated, remote attacker to modify data in the CG-NMS database by using SQL injection. The vulnerability is due to insufficient input validation. An attacker could exploit this...

Multiple Cisco Products Root Shell Access Vulnerability

Multiple Cisco products contain a vulnerability that could allow a local attacker to gain shell access with root privileges. The vulnerability is due to incorrect validation of user-supplied input processed by the command-line interface CLI on Cisco products running the affected software. A local...

USN-1668-1: Apport update

Dan Rosenberg discovered that an application running under an AppArmor profile that allowed unconfined execution of apport-bug could escape confinement by calling apport-bug with a crafted environment. While not a vulnerability in apport itself, this update mitigates the issue by sanitizing certa...

CVE-2012-4457

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant...