jenkins: failed log in attemps revealing if a user is valid or not (SECURITY-79)

The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts...

kernel: kvm: invalid parameter passing in kvm_iommu_map_pages()

A flaw was found in the way the Linux kernel's kvmiommumappages function handled IOMMU mapping failures. A privileged user in a guest with an assigned host device could use this flaw to crash the host...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2378-1)

Steven Vittitoe reported multiple stack buffer overflows in Linux kernel's magicmouse HID driver. A physically proximate attacker could exploit this flaw to cause a denial of service system crash or possibly execute arbitrary code via specially crafted devices. CVE-2014-3181 Ben Hawkes reported...

Multiple Vendor ICMP Implementation Malformed Path MTU DoS

No description provided by source. source: http://www.securityfocus.com/bid/13124/info Multiple vendor implementations of TCP/IP Internet Control Message Protocol ICMP are reported prone to several denial-of-service attacks. ICMP is employed by network nodes to determine certain automatic actions...

Valdersoft Shopping Cart 3.0 - Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/12916/info Multiple input validation vulnerabilities reportedly affect Valdersoft Shopping Cart. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out...

VirtueMart Joomla ECommerce Edition 1.0.11 Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/20236/info VirtueMart Joomla eCommerce Edition is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit these issues to execute...

openSUSE Security Update : subversion (openSUSE-SU-2013:1442-1)

This subversion update includes a security fix and several minor changes. - update to 1.7.13 bnc836245 - User-visible changes : - General - merge: fix bogus mergeinfo with conflicting file merges - diff: fix duplicated path component in '--summarize' output - raserf: ignore case when checking...

openSUSE Security Update : openssl (openSUSE-2012-52)

openssl was prone to several security issues : - DTLS Plaintext Recovery Attack CVE-2011-4108 - Uninitialized SSL 3.0 Padding CVE-2011-4576 - Malformed RFC 3779 Data Can Cause Assertion Failures CVE-2011-4577 - SGC Restart DoS Attack CVE-2011-4619 - Invalid GOST parameters DoS Attack CVE-2012-002...

How To Export Windows Event Logs

Purpose When submitting a support case for technical assistance, it is sometimes necessary to upload relevant Windows event logs in addition to the Veeam logs. Event logs exported using default settings can be missing important information. This article describes three different methods of...

Medium: lighttpd

Issue Overview: Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service segmentation fault and crash via unspecified vectors that trigger FAMMonitorDirectory failures. lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, whi...

Ubuntu Update for libyaml USN-2098-2

Check for the Version of libyaml OpenVAS Vulnerability Test $Id: gbubuntuUSN20982.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for libyaml USN-2098-2 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software...

Ubuntu: Security Advisory (USN-2098-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DOE Breach Report Blasts Poor Patching, IT Management

The U.S. Department of Energy has thrown back the covers on a July breach that exposed the personal information of more than 104,000 individuals, painting a less than flattering portrait of IT and agency management failures around vulnerability management, access controls and a general lack of...

Scientific Linux Security Update : samba4 on SL6.x i386/x86_64 (20131121)

An integer overflow flaw was found in the way Samba handled an Extended Attribute EA list provided by a client. A malicious client could send a specially crafted EA list that triggered an overflow, causing the server to loop and reprocess the list using an excessive amount of memory. CVE-2013-412...

CVE-2013-5635

Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not properly maintain the state of password failures, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by entering password guesses within multiple Unlock.e...

CVE-2013-5635

Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not properly maintain the state of password failures, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by entering password guesses within multiple Unlock.e...

Design/Logic Flaw

Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by overwriting DVREM.EPM with a copy of...

CVE-2013-5636

Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by overwriting DVREM.EPM with a copy of...

CVE-2013-5635

Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not properly maintain the state of password failures, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by entering password guesses within multiple Unlock.e...

CVE-2013-5635

Affected software : Media Encryption EPM Explorer in Check Point Endpoint Security (through E80.50). Issue : a weakness in how password failure state is maintained, enabling bypass of the device-lock protection by running multiple Unlock.exe processes concurrently. Impact : local, physically prox...