PSF-2013-1 ssl.match_hostname() wildcard DoS

Algorithmic complexity vulnerability in the ssl.matchhostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-sslmatchhostname as used for older Python versions, allows remote attackers to cause a denial of service CPU consumption via multiple wildcard...

Ubuntu Update for python3.3 USN-1985-1

Check for the Version of python3.3 OpenVAS Vulnerability Test $Id: gbubuntuUSN19851.nasl 8509 2018-01-24 06:57:46Z teissa $ Ubuntu Update for python3.3 USN-1985-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

PineApp Mail-SeCure privilege escalation

Unfiltered shell characters vulnerability...

Python SSL certificate check bypass

Invalid NULL characters processing...

USN-1985-1: Python 3.3 vulnerabilities

Florian Weimer discovered that Python incorrectly handled matching multiple wildcards in ssl certificate hostnames. An attacker could exploit this to cause Python to consume resources, resulting in a denial of service. CVE-2013-2099 Ryan Sleevi discovered that Python did not properly handle...

DavFS2 privilege escalation

Shell characters vulnerability...

Cisco Unified Computing System Arbitrary Command Execution Vulnerability

A vulnerability in the remote debug shell in Cisco Unified Computing System PALO adapter cards could allow an authenticated, local attacker to execute commands on the underlying operating system with elevated privileges. The vulnerability is due to insufficient handling of special characters. An...

Debian DSA-2763-1 : pyopenssl - hostname check bypassing

It was discovered that PyOpenSSL, a Python wrapper around the OpenSSL library, does not properly handle certificates with NULL characters in the Subject Alternative Name field. A remote attacker in the position to obtain a certificate for 'www.foo.org\0.example.com' from a CA that a SSL client...

Mandriva Linux Security Advisory : bzr (MDVSA-2013:229)

Updated bzr packages fix security vulnerabilities : A denial of service flaw was found in the way SSL module implementation of Python 3 performed matching of the certificate's name in the case it contained many '' wildcard characters. A remote attacker, able to obtain valid certificate with its...

[ MDVSA-2013:229 ] bzr

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:229 http://www.mandriva.com/en/support/security/ Package : bzr Date : September 10, 2013 Affected: Business Server 1.0 Problem Description: Updated bzr packages fix security vulnerabilities: A denial of...

CVE-2013-5706

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to error messages and 1 crafted event attributes or 2 greater than characters that are optional within a browser's...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to error messages and 1 crafted event attributes or 2 greater than characters that are optional within a browser's...

Crlf injection

CRLF injection vulnerability in the redirect servlet in Open-Xchange AppSuite and Server before 6.22.0 rev15, 6.22.1 before rev17, 7.0.1 before rev6, and 7.0.2 before rev7 allows remote attackers to inject arbitrary HTTP headers and conduct open redirect attacks by leveraging improper sanitizatio...

httpd: mod_rewrite allows terminal escape sequences to be written to the log file

modrewrite.c in the modrewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator...

Important: Red Hat Security Advisory: jbossweb security update

An update for Red Hat JBoss Enterprise Application Platform 6.1.0 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score,...

Zoom Telephonics Bypass / Traversal / Improper Handling

Five models of the Zoom Telephonics ADSL Modem/Router line suffer from multiple critical vulnerabilities, almost all being of a remote access attack vector. Models affected: Zoom X3 ADSL Modem/Router Zoom X4 ADSL Modem/Router Zoom X5 ADSL Modem/Router Zoom ADSL Bridge Modem Model 5715 1...

DSA-2742-1 php5 - interpretation conflict

Bulletin has no description...

CVE-2013-4236

VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via invalid XML characters in a guest agent response. NOTE: this issue is due to an incomplete fix for CVE-2013-0167...

Design/Logic Flaw

VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via invalid XML characters in a guest agent response. NOTE: this issue is due to an incomplete fix for CVE-2013-0167...

CVE-2013-4236

CVE-2013-4236 affects VDSM in Red Hat Enterprise Virtualization 3 and 3.2. The issue stems from an incomplete fix for CVE-2013-0167 and can allow a privileged guest user to make the host running the guest unavailable to the management server via invalid XML characters in a guest agent response. P...