3734 matches found
Firefox 3.6.x < 3.6.21 Out-of-Date CA List
The installed version of Firefox 3.6.x is earlier than 3.6.21 and is potentially affected by an out-of-date certificate authority list. Due to the issuance of several fraudulent SSL certificates, the certificate authority DigiNotar has been disabled in Mozilla Firefox. C Tenable Network Security,...
DSA-2299-1 ca-certificates - untrusted root CA
Bulletin has no description...
DigiNotar Says Its CA Infrastructure Was Compromised
VASCO, the parent company of DigiNotar, says that the fraudulent certificate for Google’s domains that the certificate authority issued was just one of many such bogus certificates it handed out in recent months, and blamed the growing scandal on an attack on its CA infrastructure. In a statement...
Design/Logic Flaw
The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains, which allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an...
CVE-2011-0228
The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains, which allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an...
EUVD-2011-0254
The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains, which allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an...
CVE-2011-0228
Affected software: Apple iOS prior to 4.2.10 and 4.3.x prior to 4.3.5. Vulnerability: The Data Security component does not check the basicConstraints parameter when validating X.509 certificate chains, allowing a non-CA certificate to sign a certificate for any domain. This enables a man-in-the-m...
CVE-2011-3011
BaseServiceImpl.class in CA ARCserve D2D r15 does not properly handle sessions, which allows remote attackers to obtain credentials, and consequently execute arbitrary commands, via unspecified vectors...
Design/Logic Flaw
BaseServiceImpl.class in CA ARCserve D2D r15 does not properly handle sessions, which allows remote attackers to obtain credentials, and consequently execute arbitrary commands, via unspecified vectors...
CVE-2011-3011
The CVE-2011-3011 issue affects CA ARCserve D2D r15’s web server, specifically the GWT RPC handling in the homepageServlet. A remote attacker can send a specially crafted GWT RPC request to trigger an information/credentials disclosure, exposing the Windows administrator credentials used by the A...
CVE-2011-3011
BaseServiceImpl.class in CA ARCserve D2D r15 does not properly handle sessions, which allows remote attackers to obtain credentials, and consequently execute arbitrary commands, via unspecified vectors...
Re: CA ARCserve D2D r15 GWT RPC Request Auth Bypass / Credentials
FYI, we have published a fix for this issue. https://support.ca.com/irj/portal/anonymous/solndtls?aparNo=RO33517&os=W INDOWS&actionID=3 A formal security notice will be published next week. Thanks and regards, Ken Williams, Director CA Technologies Product Vulnerability Response Team CA...
CA Arcserve D2D GWT RPC Credential Information Disclosure
$Id: caarcserverpcauthbypass.rb 13467 2011-08-01 21:20:29Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
CA Arcserve D2D GWT RPC Credential Information Disclosure
Exploit for jsp platform in category web applications $Id: caarcserverpcauthbypass.rb 13467 2011-08-01 21:20:29Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more informati...
CA Arcserve D2D GWT RPC - Credential Information Disclosure (Metasploit)
$Id: caarcserverpcauthbypass.rb 13467 2011-08-01 21:20:29Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
CA ARCserver D2D GWT RPC Request Multiple Vulnerabilities
CA ARCserver D2D is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2011-2667
Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption and daemon crash via a malformed...
Memory corruption
Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption and daemon crash via a malformed...
CVE-2011-2667
CA Gateway Security (and CA Total Defense r12) is affected by CVE-2011-2667 due to a flawed URL parsing loop in the Icihttp.exe module, which can overflow heap memory on HTTP requests received on port 8080. This memory corruption can enable remote attackers to execute arbitrary code or trigger a ...
CVE-2011-2667
Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption and daemon crash via a malformed...