Default configuration

The default configuration of IBM WebSphere Application Server WAS 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged acces...

NSS incorrectly permits skipping of ServerKeyExchange — Mozilla

Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services NSS where the client allows for a ECDHEECDSA exchange where the server does not send its ServerKeyExchange message instead of aborting the handshake. Instead, the NSS client will take the EC key from the ECDS...

New Analytics Tool Defines Language Used Malicious Domains

OpenDNS has gone public with a new tool that uses a blend of analytics principles found outside information security to create a threat model for detecting domains used in criminal and state-sponsored hacking campaigns. NLPRank is not ready for production, said OpenDNS director of security resear...

RESTEasy: XXE via parameter entities

It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible...

Fedora 20 : pyxdg-0.25-5.fc20 (2014-16357)

Fix CVE-2014-1624 pyxdg: TOCTOU race condition in getruntimedir when strict=False Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Microsoft Considering Public-Key Pinning for Internet Explorer

Microsoft is considering adding public-key pinning–an important defense against man-in-the-middle attacks–to Internet Explorer. The feature is designed to help protect users against the types of MITM attacks that rely on forged certificates, which comprise a large portion of those attacks...

IBM DB2 9.7 < Fix Pack 10 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 9.7 running on the remote host is affected by the following vulnerabilities : - An input-validation error exists related to handling the 'ALTER MODULE' statement that allows buffer overflows. CVE-2014-3094 - An error exists related to handling...

Web Application Protection - Tool to detect and correct vulnerabilities in PHP web applications

WAP 2.0 is a source code static analysis and data mining tool to detect and correct input validation vulnerabilities in web applications written in PHP version 4.0 or higher and with a low rate of false positives. WAP detects and corrects the following vulnerabilities: SQL Injection SQLI Cross-si...

CentOS Update for nss CESA-2014:1246 centos5

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Squid 3.x < 3.3.13 / 3.4.7 Request Processing DoS

According to its banner, the version of Squid running on the remote host is 3.x prior to 3.3.13 or 3.4.7. It is, therefore, affected by a denial of service vulnerability. The flaw exists due to user-supplied input not being properly validated in request parsing. This allows a remote attacker to...

Scientific Linux Security Update : nss and nspr on SL5.x i386/x86_64 (20140916)

A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. CVE-2013-1740 A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker coul...

Phabricator: Content Spoofing through URL

Hello I hope this is upto the level you guys think of accepting reports. Specified content can be injected into the webpage as text using the URL Consider this...

RedHat Update for nss and nspr RHSA-2014:1246-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

nss: false start PR_Recv information disclosure security issue

A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server...

Moderate: Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update

Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

AlienVault Releases Intrusion Detection Systems (IDS) Best Practices

Network security practitioners rely heavily on intrusion detection systems IDS to identify malicious activity on their networks by examining network traffic in real time. IDS are available in Network NIDS and Host HIDS forms, as well as for Wireless WIDS. Host IDS is installed via an agent on the...

Netsparker v3.5.5 - Web Application Security Scanner

Netsparker Web Application Security Scanner can find and report web application vulnerabilities such as SQL Injection and Cross-site Scripting XSS and security issues on all web applications and websites regardless of the platform and the technology they are built on. Netsparker is very easy to u...

Oracle Traffic Director Multiple Vulnerabilities (July 2014 CPU)

The remote host is running an unpatched version of Oracle Traffic Director that is affected by the following vulnerabilities : - The implementation of Network Security Services NSS does not ensure that data structures are initialized, which could result in a denial of service or disclosure of...

CentOS Update for nss-util CESA-2014:0917 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS Update for nss CESA-2014:0917 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...