CVE-2014-3577

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

Destoon前台getshell(CSRF任意代码执行)

简要描述： 测试版本 DESTOON B2B Version 5.0 Release 20140625 UTF-8 ZH-CN 详细说明： 0.问题文件 admin/tag.inc.php 95行 eval$tagcode; 未对用户提交的执行代码tagcode做安全限制 1.前台注册会员 2.进入会员中心，发布一条求购信息 信息标题：随意 行业分类：随意 产品图片：通过审查元素，修改 postthumb 的value为...

openSUSE Security Update : MozillaFirefox / MozillaThunderbird / seamonkey / etc (openSUSE-SU-2012:0567-1)

Changes in xulrunner : - update to 12.0 bnc758408 - rebased patches - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous memory safety hazards - MFSA 2012-22/CVE-2012-0469 bmo738985 use-after-free in IDBKeyRange - MFSA 2012-23/CVE-2012-0470 bmo734288 Invalid frees causes heap corruption in...

ALPINE-CVE-2014-0139

cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name CN field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certifica...

DEBIAN-CVE-2014-0139

cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name CN field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certifica...

CVE-2014-0139

cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name CN field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certifica...

CVE-2013-6422

The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification CURLOPTSSLVERIFYPEER, also disables the CURLOPTSSLVERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle MITM...

[SECURITY] [DSA 2824-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2824-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso December 19, 2013 http://www.debian.org/security/faq -...

CVE-2013-4545

cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification CURLOPTSSLVERIFYHOST when the digital signature verification CURLOPTSSLVERIFYPEER is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrar...

China hit by massive DDoS attack causing the Internet inaccessibility for hours

During the weekend China's Internet was taken down by a powerful distributed denial of service DDoS attack on the .cn domain slowed and blocked Internet access inaccessibility for hours. Security expert clarified that China could have been perpetrated by sophisticated hackers or by a single...

China .cn Domain Available Again after DDoS Attack

Long fingered as the source of denial-of-service attacks and other hacks against foreign interests, China’s .cn domain was targeted on Sunday and approximately one-third of the sites registered to that domain were kept offline for a period of time. A statement from the China Internet Network...

Oracle Linux 5 / 6 : firefox (ELSA-2012-0515)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0515 advisory. firefox: 10.0.4-1.0.1.el62 - Replace firefox-redhat-default-prefs.js with firefox-oracle-default-prefs.js 10.0.4-1 - Update to 10.0.4 ESR xulrunner...

PayPal Cross Site Scripting

====================================================================== | | | | | | \ \ / / | | | | | |/' | \ V / | | | | ' | /| \ \ /\ / / ' \ / \ | || | | | \ |/ /\ V V /| | | | / /^\ \ /|| ||/ // || || / / || ======================================================================= Hello I...

Fedora 18 : php-pear-CAS-1.3.2-1.fc18 (2012-21084)

Changes in version 1.3.2 Security Fixes : - CVE-2012-5583 Missing CN validation of CAS server certificate 58 Joachim Fritschi Bug Fixes : - Fix broken character encoding in Greek and French 40 Joachim Fritschi - Minor error corrections in a few example files Joachim Fritschi - Remove erroneous...

Fedora 17 : php-pear-CAS-1.3.2-1.fc17 (2012-21106)

Changes in version 1.3.2 Security Fixes : - CVE-2012-5583 Missing CN validation of CAS server certificate 58 Joachim Fritschi Bug Fixes : - Fix broken character encoding in Greek and French 40 Joachim Fritschi - Minor error corrections in a few example files Joachim Fritschi - Remove erroneous...

Search in LDAP the lastLogonTimestamp of Users.

This script search in LDAP the lastLogonTimestamp of Users. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20120424)

Mozilla Thunderbird is a standalone mail and newsgroup client. A flaw was found in Sanitiser for OpenType OTS, used by Thunderbird to help prevent potential exploits in malformed OpenType fonts. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute...

CentOS Update for thunderbird CESA-2012:0516 centos6

Check for the Version of thunderbird OpenVAS Vulnerability Test CentOS Update for thunderbird CESA-2012:0516 centos6 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

CentOS Update for firefox CESA-2012:0515 centos5

Check for the Version of firefox OpenVAS Vulnerability Test CentOS Update for firefox CESA-2012:0515 centos5 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

CentOS Update for thunderbird CESA-2012:0516 centos5

Check for the Version of thunderbird OpenVAS Vulnerability Test CentOS Update for thunderbird CESA-2012:0516 centos5 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...