WordPress特制字符串URL重定向限制绕过漏洞

Bugtraq ID:62344 CVE ID:CVE-2013-4339 WordPress是一种使用PHP语言开发的博客平台，用户可以在支持PHP和MySQL数据库的服务器上架设自己的网志 WordPress在处理特制的字符串时存在重定向漏洞，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，来绕过重定向限制，对目标用户进行网络钓鱼等攻击 0 WordPress 3.6 厂商解决方案 WordPress 3.6.1已经修改该漏洞，建议用户下载更新： http://codex.wordpress.org/Version3.6.1...

Fedora 19 : python-pyrad-2.0-3.fc19 (2013-15891)

Better random number genetator Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Fedora 18 : python-pyrad-2.0-3.fc18 (2013-15877)

Better random number genetator Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

PHP SSL Module "subjectAltNames"空字节处理安全绕过漏洞

Bugtraq ID:61776 PHP是一种HTML内嵌式的脚本语言 PHP SSL模块不正确处理服务器SSL证书中"subjectAltNames"通用名中的空字节，允许攻击者利用漏洞进行中间人攻击，获取敏感信息 0 PHP 5.3.27 PHP 5.4.17 PHP 5.5.1 厂商解决方案 用户可参考如下厂商提供的安全补丁以修复该漏洞： http://git.php.net/?p=php-src.git;a=commit;h=dcea4ec698dcae39b7bba6f6aa08933cbfee6755...

ISC BIND 9 SRTT算法授权服务器选择安全漏洞

BUGTRAQ ID: 61774 BIND是一个应用非常广泛的DNS协议的实现。 ISC BIND 9内的SRTT算法实现中存在漏洞，理论上此漏洞可使攻击者手动降低递归服务器与授权服务器相关联的SRTT值，从而影响特定授权服务器从NS资源记录集值内确定要查询的域服务器。SRTT选择不仅影响授权服务器，也影响递归或授权混合服务器。攻击者可利用此漏洞执行DNS相关的攻击，例如DNS缓存投毒。 0 ISC BIND 9.x 厂商补丁： ISC --- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Citrix Presentation Server 4.5 Code Execution

The version of Citrix Presentation Server installed on the remote Windows host is potentially affected by multiple code execution vulnerabilities. By sending a specially crafted packet to the IMA server process, a remote, unauthenticated attacker could execute arbitrary code subject to the...

Fedora 19 : kernel-3.10.3-300.fc19 (2013-13663)

Linux v 3.10.3 stable update contains a very large number of fixes across the tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Mozilla Firefox ESR Multiple Vulnerabilities - August12 (Windows)

This host is installed with Mozilla Firefox ESR and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbmozillafirefoxesrmultvulnaug12win.nasl 6079 2017-05-08 09:03:33Z teissa $ Mozilla Firefox ESR Multiple Vulnerabilities - August12 Windows Authors: Arun Kallavi Copyright:...

Fedora 17 : 389-ds-base-1.2.11.21-1.fc17 (2013-5349)

Here is where you give an explanation of your update. This release fixes 7 critical bugs including one security bug. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format...

Fedora 19 : clamav-0.97.8-2.fc19 (2013-10853)

Fix 963920 Update to 0.97.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Fedora 17 : clamav-0.97.8-2.fc17 (2013-10980)

Fix 963920 Update to 0.97.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Drupal Login安全模块安全绕过漏洞

Bugtraq ID:60683 Drupal是一个基于PHP语言编写的开发型CMF（内容管理框架），Drupal Login Security是一个用于Drupal的登录安全模块 Drupal Login Security模块在禁用'soft blocking'时存在安全漏洞，由于模块不正确使用字符串过滤，可导致模块忽略所有检查 0 Drupal Login Security 6.x-1.x Drupal Login Security 7.x-1.x 厂商解决方案 Drupal Login Security 6.x-1.3和7.x-1.3已经修复此漏洞，建议用户下载更新：...

Ubuntu 12.04 LTS / 12.10 / 13.04 : libxinerama vulnerability (USN-1860-1)

Ilja van Sprundel discovered multiple security issues in various X.org libraries and components. An attacker could use these issues to cause applications to crash, resulting in a denial of service, or possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding...

Solaris 10 (x86) : 148072-19 (deprecated)

SunOS 5.10x86: openssl patch. Date this patch was last updated by Sun : Dec/17/15 This plugin has been deprecated and either replaced with individual 148072 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on...

Microsoft Windows 'Win32k.sys' 本地权限提升漏洞(CVE-2013-1333)(MS13-046)

BUGTRAQ ID: 59749 CVECAN ID: CVE-2013-1333 Microsoft Windows是微软公司推出的一系列操作系统。 如果 Windows 内核模式驱动程序不正确地处理内存中的对象，则存在一个特权提升漏洞。成功利用此漏洞的攻击者可能导致系统不稳定。 0 Microsoft Windows XP Microsoft Windows Windows Server 2012 Microsoft Windows Windows RT Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft...

Fedora 18 : kernel-3.8.6-203.fc18 (2013-5368)

Update to latest stable upstream release, Linux v3.8.6. Wide variety of fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possibl...

Microsoft Windows 'Win32k.sys'本地权限提升漏洞(CVE-2013-1283)(MS13-036)

BUGTRAQ ID: 58858 CVECAN ID: CVE-2013-1283 Microsoft Windows是微软公司推出的一系列操作系统。 如果 Windows 内核模式驱动程序不正确地处理内存中的对象，则存在一个特权提升漏洞。成功利用此漏洞的攻击者可以获得更高的特权和读取任意内核内存数据。 0 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS13-036）以及相应补丁:...

Active Perl Denial of Service Vulnerability (Windows)

The host is installed with Active Perl and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: gbactiveperldosvulnwin.nasl 6093 2017-05-10 09:03:18Z teissa $ Active Perl Denial of Service Vulnerability Windows Authors: Arun Kallavi Copyright: Copyright c 2013 Greenbone...

IBM Rational AppScan Enterprise SQL注入漏洞

BUGTRAQ ID: 58686 CVECAN ID: CVE-2013-0511 IBM Rational AppScan是应用安全性软件，能够在开发的各个阶段扫描并测试所有常见的Web应用漏洞。 IBM Rational AppScan Enterprise 8.6 - 8.6.0.2没有正确过滤SQL查询内使用的某些输入，可导致SQL注入漏洞。 0 IBM Rational AppScan 8.x IBM Rational AppScan 5.x 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Fedora 17 : nginx-1.0.15-9.fc17 (2013-2955)

Make sure nginx directories are not world readable Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...