neon: Improper verification of x509v3 certificate with NULL (zero) byte in certain fields

neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...

[SECURITY] Fedora 11 Update: pcmanx-gtk2-0.3.8-8.fc11

An easy-to-use telnet client mainly targets BBS users. PCMan X is a newly developed GPL'd version of PCMan, a full-featured famous BBS client formerly designed for MS Windows only. It aimed to be an easy-to-use yet full-featured telnet client facilitating BBS browsing with the ability to process...

[SECURITY] Fedora 10 Update: pcmanx-gtk2-0.3.8-13.fc10

An easy-to-use telnet client mainly targets BBS users. PCMan X is a newly developed GPL'd version of PCMan, a full-featured famous BBS client formerly designed for MS Windows only. It aimed to be an easy-to-use yet full-featured telnet client facilitating BBS browsing with the ability to process...

Fedora Core 11 FEDORA-2009-8815 (neon)

The remote host is missing an update to neon announced via advisory FEDORA-2009-8815. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Fedora Core 10 FEDORA-2009-8794 (neon)

The remote host is missing an update to neon announced via advisory FEDORA-2009-8794. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Linux Kernel < 2.6.31-rc7 AF_IRDA 29-Byte Stack Disclosure Exploit

No description provided by source. / cve-2009-3002.c Linux Kernel 2.6.31-rc7 AFIRDA getsockname 29-Byte Stack Disclosure Jon Oberheide [email protected] http://jon.oberheide.org Information: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3002 The Linux kernel before 2.6.31-rc7 does not...

CVE-2008-7123

Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte %00 in the login parameter in an ajout action, which bypasses the regular expression check...

Code injection

Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte %00 in the login parameter in an ajout action, which bypasses the regular expression check...

CVE-2008-7123

Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte %00 in the login parameter in an ajout action, which bypasses the regular expression check...

CVE-2008-7123

CVE-2008-7123 affects zKup CMS 2.0–2.3. The vulnerability is a static code injection in admin/configuration/modifier.php that allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte (%00) in the login parameter during an ajout action, bypassing the regular ex...

CVE-2008-7068

The dbareplace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service file truncation via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have...

Fedora 11 : neon-0.28.6-1.fc11 (2009-8815)

This update includes the latest release of neon, version 0.28.6. This fixes two security issues: the 'billion laughs' attack against expat could allow a Denial of Service attack by a malicious server. CVE-2009-2473 an embedded NUL byte in a certificate subject name could allow an undetected MITM...

Perl Compress::Raw::Bzip2模块单字节溢出漏洞

CVECAN ID: CVE-2009-1884 Compress::Raw::Zlib2是Perl中使用的一个模块，提供了到zlib2压缩库的低层接口。 Compress-Raw-Bzip2模块的Bzip2.xs中的bzinflate函数存在单字节堆溢出漏洞。如果用户处理了特制的bzip2压缩流，就可以触发这个溢出，导致使用该模块的应用程序崩溃或挂起。 CPAN Compress::Raw::Bzip2 2.x 厂商补丁： CPAN ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

GnuTLS library certificate spoofing

It's possible to spoof cerificate name with NULL byte; weak MD2-hashed signatures are accepted...

WAP-Motor 18.0 File Inclusion

=============================================================== Wap-motor Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 0 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1 + Discovered By : Inj3ct0r + Site : Inj3ct0r.com + support e-mail :...

Debian Security Advisory DSA 1852-1 (fetchmail)

The remote host is missing an update to fetchmail announced via advisory DSA 1852-1. OpenVAS Vulnerability Test $Id: deb18521.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1852-1 fetchmail Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

CURL-CVE-2009-2417 embedded zero in cert name

SSL and TLS Server certificates contain one or more fields with server name or otherwise matching patterns. These strings are stored as content and length within the certificate, and thus there is no particular terminating character. curl's OpenSSL interfacing code did faulty assumptions about...

embedded zero in cert name

SSL and TLS Server certificates contain one or more fields with server name or otherwise matching patterns. These strings are stored as content and length within the certificate, and thus there is no particular terminating character. curl's OpenSSL interfacing code did faulty assumptions about...

Stack overflow

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service application crash via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrat...

DEBIAN-CVE-2009-1885

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service application crash via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrat...