CVE-2014-3604

Not-Yet-Commons-SSL (Not-Yet-Commons-SSL) CVE-2014-3604 contains a hostname verification flaw in Certificates.java: the client fails to properly verify that the server certificate CN matches the domain name. This enables MITM-style spoofing of SSL servers using arbitrary valid certificates. Affec...

Oracle Identity Manager (October 2014 CPU

The remote host is missing the October 2014 Critical Patch Update for Oracle Identity Manager. It is, therefore, affected by multiple vulnerabilities : - The application is affected by a vulnerability in Apache Commons BeanUtils in which ClassLoader objects can be set via the class attribute of a...

[ MDVSA-2014:170 ] jakarta-commons-httpclient

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:170 http://www.mandriva.com/en/support/security/ Package : jakarta-commons-httpclient Date : September 2, 2014 Affected: Business Server 1.0 Problem Description: Updated jakarta-commons-httpclient and...

serf / Apache httpcomponents HttpClient / Jakarta Commons HttpClient SSL validation bypass

Invalid parsing of certificates with NUL character in CN...

CVE-2014-8747

Cross-site scripting XSS vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages...

Cross site scripting

Cross-site scripting XSS vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages...

CVE-2014-8747

CVE-2014-8747 is a cross-site scripting (XSS) vulnerability in Drupal Commons 7.x-3.x (prior to 7.x-3.9) for Drupal. The issue affects messages in the activity stream related to content creation, where unsanitized content could allow injection of arbitrary scripts/HTML. Root cause: inadequate san...

CVE-2014-8747

Cross-site scripting XSS vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages...

Amazon Linux AMI : jakarta-commons-httpclient (ALAS-2014-410)

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle...

Amazon Linux AMI : tomcat6 (ALAS-2014-344)

It was found that when Tomcat processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat would incorrectly handle the request. A remote attacker could use this fla...

F5 Networks BIG-IP : Apache Commons FileUpload vulnerability (K15189)

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service infinite loop and CPU consumption via a crafted Content-Type header that bypasses a loop's intended exit conditions...

Fedora Update for not-yet-commons-ssl FEDORA-2014-10746

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for not-yet-commons-ssl FEDORA-2014-10729

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 20 : not-yet-commons-ssl-0.3.15-2.fc20 (2014-10729)

Fix jar path in install. Update to upstream 0.3.15. Fixes CVE-2014-3604 . Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 19 : not-yet-commons-ssl-0.3.15-2.fc19 (2014-10746)

Fix jar path in install. Update to upstream 0.3.15. Fixes CVE-2014-3604 . Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[SECURITY] Fedora 19 Update: not-yet-commons-ssl-0.3.15-2.fc19

Commons-SSL lets you control the SSL options you need in an natural way for each SSLSocketFactory, and those options won't bleed into the rest of your system...

[SECURITY] Fedora 20 Update: not-yet-commons-ssl-0.3.15-2.fc20

Commons-SSL lets you control the SSL options you need in an natural way for each SSLSocketFactory, and those options won't bleed into the rest of your system...

[SECURITY] Fedora 21 Update: not-yet-commons-ssl-0.3.15-2.fc21

Commons-SSL lets you control the SSL options you need in an natural way for each SSLSocketFactory, and those options won't bleed into the rest of your system...

Fedora 21 : not-yet-commons-ssl-0.3.15-2.fc21 (2014-10691)

Fix jar path in install. Update to upstream 0.3.15. Fixes CVE-2014-3604. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Important: jakarta-commons-httpclient

Issue Overview: Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...