Apache, IIS and other http servers allow by sending a carriage return character forged log-vulnerability warning-the black bar safety net

Description: The majority of the http server receives contains%0d%0a the request resolves to a carriage return and in the log wraps, the use of this A feature can be falsification of logs. Details: Most http servers support-such as%0 0 encoding of request, the main purpose is to provide reliable...

CVE-2007-1267

Sylpheed 2.2.7 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Sylpheed from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message...

CVE-2007-1268

Mutt 1.5.13 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Mutt from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without...

CVE-2007-1265

CVE-2007-1265 corresponds to KMail 1.9.5 and earlier failing to use GnuPG --status-fd, preventing correct visual distinction between signed and unsigned parts of multi‑component OpenPGP messages and enabling message forgery without detection. Public sources (NVD, SUSE, Ubuntu) describe the issue ...

CVE-2007-1265

Removed by vendor...

DEBIAN-CVE-2006-6944

phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers...

Fedora Core 5 : gnutls-1.2.10-3 (2006-974)

Thu Sep 14 2006 Tomas Mraz 1.2.10-3 - detect forged signatures - CVE-2006-4790 206411, patch from upstream - Tue May 16 2006 Tomas Mraz - 1.2.10-2 - added missing buildrequires Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...

Important gnutls security update

1.0.20-3.2.3 - detect forged signatures - CVE-2006-4790 206411, patch backported from upstream...

Debian DSA-1174-1 : openssl096 - cryptographic weakness

Daniel Bleichenbacher discovered a flaw in the OpenSSL cryptographic package that could allow an attacker to generate a forged signature that OpenSSL will accept as valid. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fr...

GLSA-200610-01 : Mozilla Thunderbird: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200610-01 Mozilla Thunderbird: Multiple vulnerabilities A number of vulnerabilities have been found and fixed in Mozilla Thunderbird. For details please consult the references below. Impact : The most severe vulnerabilities might...

Mozilla Thunderbird: Multiple vulnerabilities

Background The Mozilla Thunderbird mail client is a redesign of the Mozilla Mail component. Description A number of vulnerabilities have been found and fixed in Mozilla Thunderbird. For details please consult the references below. Impact The most severe vulnerabilities might lead to the execution...

CVE-2006-4981

CVE-2006-4981 affects Symantec Sygate NAC. The vulnerability allows physically proximate attackers to bypass access controls and join a local network by selecting a forged MAC address that matches an exception rule: (1) permitting all non-Windows devices or (2) whitelisting specific OUIs. The NVD...

A forged SSL server certificate can be accepted by Opera as a valid certificate – Opera Security Advisories

A forged SSL server certificate can be accepted by Opera as a valid certificate – Opera Security Advisories OPCOM Team | September 21, 2006 Summary: A forged SSL server certificate can be accepted by Opera as a valid certificate. Severity: Highly critical Vulnerable versions: Opera for desktop...

opera -- RSA Signature Forgery

Opera reports: A specially crafted digital certificate can bypass Opera's certificate signature verification. Forged certificates can contain any false information the forger chooses, and Opera will still present it as valid. Opera will not present any warning dialogs in this case, and the securi...

USN-339-1: OpenSSL vulnerability

Philip Mackenzie, Marius Schilder, Jason Waddle and Ben Laurie of Google Security discovered that the OpenSSL library did not sufficiently check the padding of PKCS 1 v1.5 signatures if the exponent of the public key is 3 which is widely used for CAs. This could be exploited to forge signatures...

CVE-2006-2706

Secure Elements Class 5 AVR server aka C5 EVM before 2.8.1 allows remote attackers to cause a denial of service via forged "session start" messages that cause AVR to connect to arbitrary hosts...

CVE-2006-2706

CVE-2006-2706 affects the Secure Elements Class 5 AVR server (aka C5 EVM) prior to version 2.8.1. The issue allows remote attackers to trigger a denial of service by sending forged "session start" messages that cause the AVR server to connect to arbitrary hosts. The vulnerability description in t...

FreeBSD : squid -- denial of service with forged WCCP messages (5fe7e27a-64cb-11d9-9e1e-c296ac722cb3)

The squid patches page notes : WCCPISEEYOU messages contain a 'number of caches' field which should be between 1 and 32. Values outside that range may crash Squid if WCCP is enabled, and if an attacker can spoof UDP packets with the WCCP router's IP address. %NASLMINLEVEL 70300 C Tenable Network...

CVE-2005-0493

The CVE-2005-0493 issue affects Biz Mail Form’s BizMail CGI (bizmail.cgi) prior to version 2.2. A CRLF injection in the email parameter lets remote, unauthenticated attackers bypass the email check and relay spam by crafting email headers via CRLF sequences. The impact is remote abuse of the mail...

CVE-2005-0493: Undefined Security Weakness

CRLF injection vulnerability in bizmail.cgi in Biz Mail Form before 2.2 allows remote attackers to bypass the email check and send spam e-mail via CRLF sequences and forged mail headers in the email parameter...