Session fixation

The ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 do not 1 encrypt mouse events, which makes it easier for man-in-the-middle attackers to perform mouse operations on machines connected to the switch by injecting network traffic; and do not 2 s...

CVE-2009-1474

The ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 do not 1 encrypt mouse events, which makes it easier for man-in-the-middle attackers to perform mouse operations on machines connected to the switch by injecting network traffic; and do not 2 s...

CVE-2009-1474

The CVE-2009-1474 issue affects ATEN KH1516i (firmware 1.0.063) and KN9116 (firmware 1.1.104). It states that mouse events are not encrypted and the session cookie is not marked Secure in HTTPS, enabling potential man-in-the-middle abuse and cookie interception over HTTP. Connected sources confir...

CVE-2009-0089

Windows HTTP Services aka WinHTTP in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Vista Gold allows remote web servers to impersonate arbitrary https web sites by using DNS spoofing to "forward a connection" to a different https web site that has a valid certificate...

CVE-2009-0089

CVE-2009-0089 describes a vulnerability in Windows HTTP Services (WinHTTP) where remote servers could impersonate HTTPS sites via DNS spoofing and forward a connection to a host with a valid certificate for a different domain. Affected: Windows 2000 SP4, XP SP2/SP3, Server 2003 SP1/SP2, and Vista...

CVE-2009-0089

Windows HTTP Services aka WinHTTP in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Vista Gold allows remote web servers to impersonate arbitrary https web sites by using DNS spoofing to "forward a connection" to a different https web site that has a valid certificate...

Protection against Microsoft Windows HTTP Services Certificate Name Mismatch Remote Code Execution Vulnerability (MS09-013)

A spoofing vulnerability has been reported in Microsoft Windows HTTP Services. Windows HTTP Services WinHTTP provides developers with an HTTP client application programming interface API to send requests through the HTTP protocol to other HTTP servers. A remote attacker may exploit this issue to...

SQL injection

Added: 04/10/2009 Background Structured Query Language SQL is the most common language understood by modern relational databases. Problem A web program uses input parameters within an SQL query in an unsafe manner. This could allow a remote attacker to inject arbitrary SQL commands via a speciall...

CVE-2009-0626

The CVE-2009-0626 entry covers Cisco IOS WebVPN/SSLVPN vulnerabilities in 12.3–12.4. A crafted HTTPS packet can cause a device reload/hang (Crash). The adjacent CVE-2009-0628 describes a memory‑leak condition in SSLVPN sessions that can exhaust memory and crash the device. Affected releases inclu...

CVE-2009-0626

The SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service device reload or hang via a crafted HTTPS packet...

Ubuntu: Security Advisory (USN-596-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for ruby1.8 vulnerabilities USN-596-1

Ubuntu Update for Linux kernel vulnerabilities USN-596-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN5961.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for ruby1.8 vulnerabilities USN-596-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Ubuntu: Security Advisory (USN-519-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for elinks vulnerability USN-519-1

Ubuntu Update for Linux kernel vulnerabilities USN-519-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN5191.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for elinks vulnerability USN-519-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

RedHat Update for thunderbird RHSA-2008:0105-02

Check for the Version of thunderbird OpenVAS Vulnerability Test RedHat Update for thunderbird RHSA-2008:0105-02 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it und...

Fedora Update for Miro FEDORA-2007-3962

Check for the Version of Miro OpenVAS Vulnerability Test Fedora Update for Miro FEDORA-2007-3962 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Fedora Update for kdepim FEDORA-2007-2985

Check for the Version of kdepim OpenVAS Vulnerability Test Fedora Update for kdepim FEDORA-2007-2985 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Safari < 3.2.2 Multiple Vulnerabilities

Binary data 4932.prm...

Safari < 3.2.2 Multiple Vulnerabilities

The version of Safari installed on the remote Windows host is earlier than 3.2.2. Such versions reportedly have multiple security vulnerabilities : - Input validation issues in their handling of 'feed:' URLs, which could be abused to execute arbitrary JavaScript code in the local security zone. -...

SquirrelMail HTTPS Session Cookie Secure Flag Weakness

The version of SquirrelMail installed on the remote host does not set the 'secure' flag for session cookies established when communicating over SSL / TLS. This could lead to disclosure of those cookies if a user issues a request to a host in the same domain over HTTP as opposed to HTTPS...