96 matches found
DEBIAN-CVE-2017-12150
It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text...
ownCloud: Password Complexity Not Enforced On Password Change
Hi! Owncloud does not enforce password complexity on password change, so it's possible to use passwords of any size or form. In example I can set my password to be "a" or "qwerty". How to reproduce: Change your password to something that does not match your required complexity. Proof Of Concept:...
BSA-2017-441
Security Advisory ID : BSA-2017-441 Component : Samba Revision : 2.0: Interim It was found that samba did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text. Affected Products...
Sensitive Information Leakage
Moodle is vulnerable to sensitive information leakage. Privacy settings for the IMS-LT which includes the sendname, sendemailaddr, and acceptgrades settings are not properly enforced, allowing the transfer of personal sensitive information...
postgresql: libpq ignores PGREQUIRESSL environment variable
It was discovered that the PostgreSQL client library libpq did not enforce the use of TLS/SSL for a connection to a PostgreSQL server when the PGREQUIRESSL environment variable was set. An man-in-the-middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a...
Unspecified Vulnerability in Blue Coat Systems Unified Agent
Blue Coat Systems Unified Agent is a unified agent client from Blue Coat Systems, USA. A security vulnerability exists in Blue Coat Systems Unified Agent versions prior to 4.6.2. Due to a failure to restrict modification of configuration files when the program is running in locally enforced mode....
6: JSM policy not respected by deployed applications
It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to...
Secret: SSL Not Enforced
Although by default, all the communication in the Secret web app happens over HTTPS, if this is changed to HTTP, the requests are still normally processed. For example, the request to send a download link to a phone number can be as simple as POST //send-download-link HTTP/1.1 Host: www.secret.ly...
Anti-Spoofing might be enforced incorrectly in specific scenarios on R75.47 Security Gateway
...
[DEP Process Scanner] Tool to scan and show all the DEP enabled Processes
DEP Process Scanner is the free command-line tool to scan and show all the DEP enabled Processes. Data Execution Prevention DEP is a security feature introduced since Windows XP SP2 onwards and designed to prevent an application executing code from a non-executable memory regions such as Stack or...
Juniper Junos web-authentication Policy Not Enforced (PSN-2012-10-735)
According to its self-reported version number, the remote Junos device stops enforcing a web-authentication policy if its client-match statement is removed. This would allow unauthenticated access to resources that are assumed to be protected by web-authentication. C Tenable Network Security, Inc...
Vulnerability in core server (CVE-2010-1975)
An unprivileged database user can remove superuser-only settings that were applied to his account with ALTER USER by a superuser, thus bypassing settings that should be enforced...
pidgin: ignores SSL/TLS requirements with old jabber servers
protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption an...
Debian DSA-1338-1 : iceweasel - several vulnerabilities
Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3089 Ronen Zilberman and Michal Zalewski discovered that a timing race...
