3864 matches found
Google could be forged domain mailbox fishing-vulnerability warning-the black bar safety net
! Recently Google Apps for Work exposed a vulnerability that an attacker can use the vulnerability to falsification of any of the site's domain name mailbox, posing as company employees to the victims, sending phishing mail. Google domain mail service 如果 你 想 弄 一 个 类似 [email protected] 的 DIY 邮箱 来 代替...
DSA-3161-1 dbus - security update
Bulletin has no description...
tinyproxy: denial of service
It was discovered that a remote attacker is able to cause a denial of service CPU and memory consumption via 1 a large number of headers or 2 a large number of forged headers that predictably trigger hash collisions...
CVE-2014-6324
The Kerberos Key Distribution Center KDC in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a...
PT-2014-2025
Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2003 SP2 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Description The Kerberos Key...
Microsoft Considering Public-Key Pinning for Internet Explorer
Microsoft is considering adding public-key pinning–an important defense against man-in-the-middle attacks–to Internet Explorer. The feature is designed to help protect users against the types of MITM attacks that rely on forged certificates, which comprise a large portion of those attacks...
CVE-2014-7725
The Rally Albania Live 2014 aka com.wRallyAlbaniaLIVE2014 application 0.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-7707
The Outdoor Design And Living aka com.pocketmagsau.outdoordesignandliving application @7F080181 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Mozilla Network Security Services RSA Signature Forgery (CVE-2014-1568)
An RSA signature forgery vulnerability exists in Mozilla Network Security Services NSS, the cryptographic library used in many applications including Firefox and Google Chrome. The vulnerability is a result of improper verification of RSA signatures due to incorrect ASN.1 parsing of the DigestInf...
ntopng 1.2.0 - XSS Injection
No description provided by source. ntopng 1.2.0 XSS injection using monitored network traffic ntopng is the next generation version of the original ntop, a network traffic probe and monitor that shows the network usage, similar to what the popular top Unix command does. The web-based frontend of...
ntopng 1.2.0 - XSS Vulnerability
ntopng version 1.2.0 suffers from a cross site scripting vulnerability using monitored network traffic. ntopng 1.2.0 XSS injection using monitored network traffic ntopng is the next generation version of the original ntop, a network traffic probe and monitor that shows the network usage, similar ...
DoS attacks (ICMPv6-based) resulting from IPv6 EH drops
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Folks, Ten days ago or so we published this I-D: http://www.ietf.org/internet-drafts/draft-gont-v6ops-ipv6-ehs-in-real-world-00.txt Section 5.2 of the I-D discusses a possible attack vector based on a combination of "forged" ICMPv6 PTB messages and IP...
Ribose Cross Site Request Forgery
Hi Team, Please find the attached description and the PoC for the vulnerability identified. Vulnerability: CSRF Attack on Ribose Online Social Collaboration Platform Date: 13/08/2014 Author: JoeV Vendor: www.ribose.com Tested on: Windows 7 Description: A CSRF attack forces a logged-on victim’s...
ID Software Quake 3 "smurf attack" Denial of Service vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3060/info Quake 3 network play features contain a remotely exploitable denial of service vulnerability. A hostile client program can be used by to generate a large number of forged client queries on behalf of a target use...
PIX Firewall 2.7/3.x/4.x/5 Forged TCP RST Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1454/info A connection through a Cisco Secure PIX Firewall can be reset by a third party if the source and destination IP addresses and ports of the connection can be determined or inferred. This can be accomplished by...
iodined <= 0.4.2-2 (forged DNS packet) Denial of Service Exploit
No description provided by source. !/usr/bin/perl iodined = 0.4.2 DoS exploit by Albert Sellares whatsatwekkdotnet http://www.wekk.net 2009-04-26 This exploit shuts down the iodined daemon using a forged DNS packet. It works on the last debian stable version 0.4.2-2. It produces a segmentation...
Updated musl package fixes CVE-2014-3484
Updated musl package fixes security vulnerability: A remote stack-based buffer overflow has been found in musl libc's dns response parsing code. The overflow can be triggered in programs linked against musl libc and making dns queries via one of the standard interfaces getaddrinfo, getnameinfo,...
AIX 6.1 TL 7 : ntp (IV58413)
The monlist feature in ntpd in NTP allows remote attackers to cause a denial of service traffic amplification via forged 1 REQMONGETLIST or 2 REQMONGETLIST1 requests. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory...
DEBIAN-CVE-2014-0239
The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service CPU and bandwidth consumption via a forged response packet that triggers a...
CVE-2014-0239
The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service CPU and bandwidth consumption via a forged response packet that triggers a...