Real Time Network Monitoring: Cyberprobe

Real Time Network Monitoring Cyberprobe is a distrbuted architecture for real-time monitoring of networks against attack. The software consists of a number of components, including: a probe, which collects data packets and forwards it over a network in standard streaming protocols. a monitor, whi...

DEBIAN-CVE-2016-7142

The msasl module in InspIRCd before 2.0.23, when used with a service that supports SASLEXTERNAL authentication, allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted SASL message...

openstack-neutron: ICMPv6 source address spoofing vulnerability

Neutron functionality includes internal firewall management between networks. Due to the relaxed nature of particular rules, it is possible for machines on the same layer 2 networks to forge non-IP traffic, such as ARP and DHCP requests...

Cisco Application Policy Infrastructure Controller Enterprise Module Security Bypass Vulnerability

The Cisco Application Policy Infrastructure Controller Enterprise Module is a suite of applications that provide policy-based use for automated configuration of end-to-end infrastructure controllers. A security bypass vulnerability exists in the API of the Cisco Application Policy Infrastructure...

TripleO Heat templates design flaw

TripleO Heat templates tripleo-heat-templates is a set of tools for describing samples of multi-host infrastructure. A security vulnerability exists in TripleO Heat templates. When the program is deployed using the command line interface, a remote attacker can exploit this vulnerability to forge...

Vulnerability of Firefox and Firefox ESR browsers, which allows a hacker to forge the address bar

The vulnerability in the browser/base/content/browser.js function of Firefox and Firefox ESR is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to forge the URL address line remotely...

Vulnerability of Firefox and Firefox ESR browsers, which allows a hacker to forge the address bar

The vulnerability of Firefox and Fierfox ESR is related to errors in the implementation of functions for returning to the original page. Exploiting this vulnerability allows a malicious actor to manipulate the URL by using the history.back method and the location.protocol property...

The vulnerability of the Microsoft .NET Framework software platform, which allows a perpetrator to forge digital signatures

The vulnerability of the Microsoft .NET Framework software arises from improper validation of digital signatures for individual elements of XML documents. Exploiting this vulnerability allows a malicious actor to forge digital signatures using modified XML documents...

RSA package for Python spoofing vulnerability

RSA package for Python is a Python RSA implementation that supports encryption and decryption, signing and verifying signatures, key generation and more. The 'verify' function of Python-RSA has a security vulnerability that allows a remote attacker to forge signatures using special signature...

Phusion Passenger Spoofing Vulnerability

Phusion Passenger is an Apache module for deploying Ruby on Rails projects on Apache and Nginx web servers. A security vulnerability exists in the agent/Core/Controller/SendRequest.cpp file of Phusion Passenger, which allows a remote attacker to forge the request header passed to the application ...

Log forging vulnerability

It is possible to fake log entries in FishEye/Crucible logs, by sending specially crafted http requests containing a newline character. For example going to the url /changelog/asd%0AFake%20log%20entry will cause the following to be logged: code 2015-03-24 09:59:09,564 INFO qtp1610928748-315 fishe...

Log forging vulnerability

It is possible to fake log entries in FishEye/Crucible logs, by sending specially crafted http requests containing a newline character. For example going to the url /changelog/asd%0AFake%20log%20entry will cause the following to be logged: code 2015-03-24 09:59:09,564 INFO qtp1610928748-315 fishe...

The vulnerability of the Mac OS X operating system, which allows a hacker to manipulate timestamps

The vulnerability of the Mac OS X operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to forge timestamps due to errors in restricting access to the date and time settings panel...

ThinkSNS 4.0 一处设计缺陷（可伪造任意人发朋友圈）

简要描述： 通常用于诈骗！ 详细说明： 官方的demo已经是4.0，可惜下不到源码 翻来看看ThinkSNS 3.0的源码，发现一处严重的设计缺陷 apps\public\Lib\Action\AccountAction.class.php 下doSaveProfile方法为保存用户信息操作 / 保存基本信息操作 @return json 返回操作后的JSON信息数据 / public function doSaveProfile $res = true; // 保存用户表信息 if!empty$POST'sex' $save'sex' = 1 == intval$POST'sex' ?...

Log forging vulnerability

It is possible to fake log entries in FishEye/Crucible logs, by sending specially crafted http requests containing a newline character. For example going to the url /changelog/asd%0AFake%20log%20entry will cause the following to be logged: code 2015-03-24 09:59:09,564 INFO qtp1610928748-315 fishe...

Log forging vulnerability

It is possible to fake log entries in FishEye/Crucible logs, by sending specially crafted http requests containing a newline character. For example going to the url /changelog/asd%0AFake%20log%20entry will cause the following to be logged: code 2015-03-24 09:59:09,564 INFO qtp1610928748-315 fishe...

Ubuntu 14.04 LTS : Kerberos vulnerabilities (USN-2498-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2498-1 advisory. It was discovered that Kerberos incorrectly sent old keys in response to a -randkey -keepold request. An authenticated remote attacker could use this iss...

SUSE-SU-2015:0290-1 Security update for krb5

MIT kerberos krb5 was updated to fix several security issues and bugs. Security issues fixed: CVE-2014-5351: The kadm5randkeyprincipal3 function in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 aka krb5 sent old keys in a response to a -randkey -keepold request, which allowed remote...

KesionCMS最新版本可伪造任何人发表评论

简要描述： KesionCMS最新版本可伪造任何人发表评论 详细说明： 1.首先登陆官网的一个demo http://demo.kesioncms.com 2.随便找一条贴子发表评论 这里就找到了管理员更新的一篇文章 url:http://demo.kesion.com/html/xwpd/gn/2629.html 3.发表评论.得到请求的url...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...