4270 matches found
gnutls: incorrect verification of SSL certificate with NUL in name (GNUTLS-SA-2009-4)
libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's 1 Common Name CN or 2 Subject Alternative Name SAN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued b...
Authorization
fhttpd 0.4.2 allows remote attackers to cause a denial of service crash via an Authorization HTTP header with an invalid character after the Basic value...
CVE-2009-1876
Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vulnerability."...
Mandrake Security Advisory MDVSA-2009:189 (apache-mod_auth_mysql)
The remote host is missing an update to apache-modauthmysql announced via advisory MDVSA-2009:189. OpenVAS Vulnerability Test $Id: mdksa2009189.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:189 apache-modauthmysql Authors: Thomas Reinke Copyright:...
RedHat Security Advisory RHSA-2009:1207
The remote host is missing updates to Netscape Portable Runtime NSPR and Network Security Services NSS announced in advisory RHSA-2009:1207. These updated packages upgrade NSS from the previous version, 3.12.2, to a prerelease of version 3.12.4. The version of NSPR has also been upgraded from 4.7...
Fedora Core 11 FEDORA-2009-8507 (viewvc)
The remote host is missing an update to viewvc announced via advisory FEDORA-2009-8507. OpenVAS Vulnerability Test $Id: fcore20098507.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-8507 viewvc Authors: Thomas Reinke Copyright: Copyright c 2009 E-So...
TGS CMS 0.x (XSS/SQL/FD) Multiple Remote Vulnerabilities
No description provided by source. | | | / | | / | | | \ / | | | / / | |/ \ / / |/ | |/| | | ' \ / | / / | | | | | | | | | | | | | |/ / ||//\||| |||| ||,/| +-+-+-+-+ |C|r|e|w| +-+-+-+-+ TGS CMS Cross Site Scripting,SQL injection,Blind SQL/XPath injection,Source code disclosure, Multiple...
curl: incorrect verification of SSL certificate with NUL in name
lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate...
Fedora 11 : viewvc-1.1.2-2.fc11 (2009-8507)
CHANGES in 1.1.2: - security fix: validate the 'view' parameter to avoid XSS attack - security fix: avoid printing illegal parameter names and values - add optional support for character encoding detection issue 400 - fix username case handling in svnauthz module issue 419 - fix cvsdbadmin/svnadm...
firefox/nss: doesn't handle NULL in Common Name properly
Mozilla Network Security Services NSS before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to...
OpenLDAP -- incorrect handling of NULL in certificate Common Name
Jan Lieskovsky reports: OpenLDAP does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authori...
About the database the anti download the new strokes of the“# % of”a text analysis-vulnerability warning-the black bar safety net
Database this thing who don't know? As long as webmasters or play Black the all clear however, once a Y download, and that is no joke. The title phrase See the 7 on the X-Files a database the anti download the new strokes of the“%,”A text, looks like the author speaking of having problems. Purely...
Mandriva Linux Security Advisory : apache-mod_auth_mysql (MDVSA-2009:189-1)
A vulnerability has been found and corrected in modauthmysql : SQL injection vulnerability in modauthmysql.c in the mod-auth-mysql aka libapache2-mod-auth-mysql module for the Apache HTTP Server 2.x allows remote attackers to execute arbitrary SQL commands via multibyte character encodings for...
firefox/nss: doesn't handle NULL in Common Name properly
Mozilla Network Security Services NSS before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to...
firefox/nss: doesn't handle NULL in Common Name properly
Mozilla Network Security Services NSS before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to...
DEBIAN-CVE-2009-2408
Mozilla Network Security Services NSS before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to...
PHP Live! 3.2.1/2 (x) Remote Blind SQL Injection Exploit
No description provided by source. !/usr/bin/perl Original discover author banner PhpLive 3.2.1/2 x Blind SQL injection -X | |/ / || |/ | / | \ \ \ / / | \ / / \ | ' | | || | / | \ // / / / | , / ||\|||| ||| // // / // Red n'black i dress eagle on my chest. It's good to be an ALBANIAN...
openSUSE Security Update : htop (htop-332)
insufficient character filters in htop when displaying commands allowed programs that rewrite their program name to inject escape sequences CVE-2008-5076. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...
Linux Kernel <= 2.6.28.3 set_selection() UTF-8 Off By One Local Exploit
No description provided by source. / CVE-2009-1046 Virtual Console UTF-8 setselection off-by-onetwo Memory Corruption Linux Kernel = 2.6.28.3 coded by: sgrakkyu at antifork.org http://kernelbof.blogspot.com/2009/07/even-when-one-byte-matters.html Dedicated to all people talking nonsense about non...
Null pointer dereference
The CFCharacterSetInitInlineBuffer method in CoreFoundation.dll in Apple Safari 3.2.3 allows remote attackers to cause a denial of service NULL pointer dereference and application crash or possibly execute arbitrary code via a "high-bit character" in a URL fragment for an unspecified protocol...