Cisco Prime LAN Management Solution Remote Command Execution (CVE-2012-6392)

A remote command execution vulnerability exists in Cisco Prime LAN Management Solution. The vulnerability is due to use of non encrypted connection with the server. A successful exploitation would allow the attacker to execute commands, and send files...

SPDY information disclosure — Mozilla

Security researchers Thai Duong and Juliano Rizzo reported that SPDY's request header compression leads to information leakage, which can allow the extraction of private data such as session cookies, even over an encrypted SSL connection...

APPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001 OS X Lion v10.7.3 and Security Update 2012-001 is now available and addresses the following: Address Book Available for: OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2...

CVE-2011-3444

Address Book in Apple Mac OS X before 10.7.3 automatically switches to unencrypted sessions upon failure of encrypted connections, which allows remote attackers to read CardDAV data by terminating an encrypted connection and then sniffing the network...

Multiple Products STARTTLS Plaintext Command Injection (CVE-2011-0411; CVE-2014-3556)

STARTTLS is an extension to plaintext communication protocols that offers a way to upgrade plain text communications to an encrypted TLS or SSL connection. Protocols such as SMTP and FTP can be TLS-secured with a compatible server by a client sending the STARTTLS command. A command injection...

Farmville Compromises Facebook - Facebook Fixes Flaw !

After the release of FireSheep, Facebook took an important step to help protect Facebook user accounts by allowing users to choose to keep an encrypted connection as long as they used just Facebook and intelligently designed apps. Savvy users immediately discovered that if they tried to use gross...

Twitter offers encryption to beat hackers !

Twitter is offering users better protection from hackers with a new option to always use an encrypted connection to access its microblogging service. The measure is particulary designed to defend those who access Twitter via unsecured public Wi-Fi networks, which can make it easy for hackers to...

squirrelmail: session hijacking - secure flag not set for HTTPS-only cookies

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...

nss_ldap, openldap security update

CentOS Errata and Security Advisory CESA-2005:751-01 Updated openldap and nssldap packages that correct a potential password disclosure issue are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. OpenLDAP is an open source suite of...

SSL Tunneling

...

SUSE-SA:2003:039: openssh (second release)

The remote host is missing the patch for the advisory SUSE-SA:2003:039 openssh second release. The openssh package is the most widely used implementation of the secure shell protocol family ssh. It provides a set of network connectivity tools for remote shell login, designed to substitute the...