Design/Logic Flaw

cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification CURLOPTSSLVERIFYHOST when the digital signature verification CURLOPTSSLVERIFYPEER is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrar...

CVE-2013-4545

cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification CURLOPTSSLVERIFYHOST when the digital signature verification CURLOPTSSLVERIFYPEER is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrar...

CVE-2013-4545

cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification CURLOPTSSLVERIFYHOST when the digital signature verification CURLOPTSSLVERIFYPEER is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrar...

CVE-2013-4545

CVE-2013-4545 affects curl/libcurl 7.18.0–7.32.0 when built with OpenSSL: if CURLOP_SSL_VERIFYPEER is disabled, it also disables CN and SAN verification (CURLOPT_SSL_VERIFYHOST), enabling MITM spoofing with any valid certificate. Connected IBM CS bulletins describe remediation via firmware update...

CVE-2013-4545

cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification CURLOPTSSLVERIFYHOST when the digital signature verification CURLOPTSSLVERIFYPEER is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrar...

WordPress Elemin Shell Upload

Exploit Title : Wordpress Themes Elemin Arbitrary File Upload Vulnerability Author : ReC0ded Vendor : http://themify.me/ Download : http://themify.me/themes/Elemin Date : 22, November 2013. Type : php, html, htm, asp, etc. Category : Web Applications Vulnerability : File Upload Tested On : Window...

WordPress Blogggie Shell Upload

Exploit Title : Wordpress Themes Bloggie Arbitrary File Upload Vulnerability Author : ReC0ded Vendor : http://themify.me/ Download : http://themify.me/themes/Bloggie Date : 22, November 2013. Type : php, html, htm, asp, etc. Category : Web Applications Vulnerability : File Upload Tested On :...

WordPress Folo Shell Upload

Exploit Title : Wordpress Themes Folo Arbitrary File Upload Vulnerability Author : ReC0ded Vendor : http://themify.me/ Download : http://themify.me/themes/folo Date : 22, November 2013. Type : php, html, htm, asp, etc. Category : Web Applications Vulnerability : File Upload Tested On : Windows 7...

Mandriva Linux Security Advisory : curl (MDVSA-2013:276)

Updated curl packages fix security vulnerability : Scott Cantor discovered that curl, a file retrieval tool, would disable the CURLOPTSSLVERIFYHOST check when the CURLOPTSSLVERIFYPEER setting was disabled. This would also disable ssl certificate host name checks when it should have only disabled...

Debian DSA-2798-1 : curl - unchecked ssl certificate host name

Scott Cantor discovered that curl, a file retrieval tool, would disable the CURLOPTSSLVERIFYHOST check when the CURLOPTSSLVERIFYPEER setting was disabled. This would also disable ssl certificate host name checks when it should have only disabled verification of the certificate trust chain. The...

[SECURITY] [DSA 2798-2] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2798-2 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso November 20, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2798-2] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2798-2 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso November 20, 2013 http://www.debian.org/security/faq -...

MGASA-2013-0338 Updated curl packages fix CVE-2013-4545

Updated curl packages fix security vulnerability: Scott Cantor discovered that curl, a file retrieval tool, would disable the CURLOPTSSLVERIFYHOST check when the CURLOPTSSLVERIFYPEER setting was disabled. This would also disable ssl certificate host name checks when it should have only disabled...

Updated curl packages fix CVE-2013-4545

Updated curl packages fix security vulnerability: Scott Cantor discovered that curl, a file retrieval tool, would disable the CURLOPTSSLVERIFYHOST check when the CURLOPTSSLVERIFYPEER setting was disabled. This would also disable ssl certificate host name checks when it should have only disabled...

WordPress Suco Shell Upload

Title : Wordpress Suco Themes Arbitrary File Upload Author : DevilScreaM Date : 11/20/2013 - 20 November 2013 Category : Web Applications Type : PHP Vendor : http://themify.me/ Link : http://themify.me/themes/suco Greetz : 0day-id.com | newbie-security.or.id | Borneo Security | Indonesian Securit...

[SECURITY] [DSA 2798-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2798-1 [email protected] http://www.debian.org/security/ Michael Gilbert November 17, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2798-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2798-1 [email protected] http://www.debian.org/security/ Michael Gilbert November 17, 2013 http://www.debian.org/security/faq -...

DSA-2798-1 curl - unchecked ssl certificate host name

Bulletin has no description...

Limonade Framework 3.0 Local File Disclosure

Exploit Title: Limonade framework Local file disclosure filtering bypass Date: 2013 17 November Exploit Author: Yashar shahinzadeh Special thanks to Mormoroth Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir Vendor Homepage: http://limonade-php.github.io/‎ Tested on: Linux Ubuntu, PHP...

Debian Security Advisory DSA 2798-1 (curl - unchecked ssl certificate host name)

Scott Cantor discovered that curl, a file retrieval tool, would disable the CURLOPTSSLVERIFYHOST check when the CURLOPTSSLVERIFYPEER setting was disabled. This would also disable ssl certificate host name checks when it should have only disabled verification of the certificate trust chain. The...