Linux kernel OZWPAN driver denial of service vulnerability (CNVD-2015-03715)

Linux kernel is an open source operating system.OZWPAN is one of the drivers for receiving, parsing and forwarding network packets. The Linux kernel OZWPAN driver has a security vulnerability due to the 'ozusbrx' and 'ozusb handleepdata' functions fail to properly check the size of a particular...

PT-2013-64: Access Control Bypassing in Bitrix CMS

The specialists of the Positive Research center have detected an Access Control Bypassing vulnerability in Bitrix CMS. This vulnerability has been discovered in the integrity check mechanism of the "Script Integrity Monitor", which allows an attacker to forge the integrity check mechanism and...

SSL/TLS: CBC padding timing attack (lucky-13)

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct...

SSL/TLS: CBC padding timing attack (lucky-13)

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct...

CVE-2012-4491

The vulnerability CVE-2012-4491 affects the Drupal module Monthly Archive by Node Type (6.x). The issue is improper permission checks defined by node_access modules, enabling remote attackers to access restricted nodes through unspecified vectors. The available references corroborate that the pro...

CVE-2010-1617

user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page...

Bahamut IRCd format string bug

Format string bug during ident check...

[NT] ASP Client Check SQL Injection Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion When was the last time you checked your server's security? How about a monthly report? http://www.AutomatedScanning.com - Know that you're...

CVE-2001-1125

Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site...