3407 matches found
Security Bulletin: Information disclosure in WebSphere Application Server (CVE-2017-1381)
Summary There is an information disclosure in the WebSphere Application Server Proxy Server or On-Demand-Router ODR. This only occurs when the system clock is changed. If the system clock is changed it could cause stale data to be cached and served. Vulnerability Details CVEID: CVE-2017-1381...
Security Bulletin: Vulnerability in IBM WebSphere Application Server Edge Component Caching Proxy (CVE-2015-5004)
Summary The Edge Component Caching Proxy in IBM WebSphere Application Server could provide weaker than expected security. This is only an issue if you are using the Edge Caching proxy. Vulnerability Details CVEID: CVE-2015-5004 DESCRIPTION: IBM WebSphere Application Server Edge Component Caching...
Pornhub: Blind SQL injection and making any profile comments from any users to disappear using "like" function (2 in 1 issues)
Researcher found a blind SQL injection in the profile comment Like functionality, executing on the second request made for a given comment dislikes. Summary The injection was found manually, used discovery methods are basically the same as described in this awesome article by @gerbenjavado:...
PVS Accelerator fails to cache and shows status: "Incompatible protocol version"
When PVS Target Devices that have been configured for PVS Accelerator caching boot, the XenServer PVS Accelerator fails to initialize the caching correctly. The caching status of the target will change from Stopped to Initialized and then eventually to"Incompatible Protocol version"...
DEBIAN-CVE-2018-11469
Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 if cache enabled allows attackers to achieve information disclosure via an unauthenticated remote request, related to the protohttp.c checkrequestforcacheability function...
CVE-2018-11469
CVE-2018-11469 affects HAProxy 1.8.x (1.8.0–1.8.9 with caching enabled) where incorrect caching of responses including an Authorization header can disclose information via unauthenticated remote requests. Root cause cited: proto_http.c check_request_for_cacheability. Several connected advisories ...
CVE-2018-11469
Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 if cache enabled allows attackers to achieve information disclosure via an unauthenticated remote request, related to the protohttp.c checkrequestforcacheability function...
cxf: CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens
It was found that the token cacher in Apache cxf uses a flawed way of caching tokens that are associated with the delegation token received from Security Token Service STS. This vulnerability could allow an attacker to craft a token which could return an identifier corresponding to a cached token...
FreeBSD : BIND -- multiple vulnerabilities (94599fe0-5ca3-11e8-8be1-d05099c0ae8c)
ISC reports : An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. A problem with the implementation of the new serve-stale feature in BIND 9.12 can le...
BIND -- multiple vulnerabilities
ISC reports: An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. A problem with the implementation of the new serve-stale feature in BIND 9.12 can lea...
Cache poisoning and other dirty tricks
by @bo0om, Wallarm Research Caching is a great technology practice. It makes life better for everybody — clients get the data faster, servers expend fewer resources and so on. There is even a whole CDN industry that was built to deliver caching as a service. There are many examples of caching...
[SECURITY] Fedora 27 Update: knot-resolver-2.3.0-1.fc27
The Knot DNS Resolver is a caching full resolver implementation written in C and LuaJIT, including both a resolver library and a daemon. Modular architecture of the library keeps the core tiny and efficient, and provides a state-machine like API for extensions. The package is pre-configured as...
[SECURITY] Fedora 26 Update: knot-resolver-2.3.0-1.fc26
The Knot DNS Resolver is a caching full resolver implementation written in C and LuaJIT, including both a resolver library and a daemon. Modular architecture of the library keeps the core tiny and efficient, and provides a state-machine like API for extensions. The package is pre-configured as...
[SECURITY] Fedora 28 Update: knot-resolver-2.3.0-1.fc28
The Knot DNS Resolver is a caching full resolver implementation written in C and LuaJIT, including both a resolver library and a daemon. Modular architecture of the library keeps the core tiny and efficient, and provides a state-machine like API for extensions. The package is pre-configured as...
Ansible Man-in-the-Middle Attack Vulnerability
Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage and orchestrate computer systems. A security vulnerability exists in Ansible versions prior to 1.2.1 that stems from the program failing to cache SSH host keys. A remote attacker can exploit...
CVE-2013-2233
Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys...
CVE-2013-2233
Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys...
UBUNTU-CVE-2013-2233
Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys...
