CVE-2012-2125

RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack...

CVE-2012-2125

RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack...

Design/Logic Flaw

RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack...

CVE-2012-2125

RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack...

CVE-2012-2125

CVE-2012-2125 affects RubyGems prior to 1.8.23, where HTTPS connections could be redirected to HTTP, enabling a remote attacker to observe or modify a gem during installation via a man‑in‑the‑middle. The accompanying open‑source advisories and OS patch references document this issue across multip...

CVE-2012-2125

RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack...

CVE-2012-2125: Undefined Security Weakness

RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack...

Discuz!配置不当可导致CSRF发帖

简要描述： Discuz!配置不当可导致CSRF发帖 详细说明： 这个漏洞中评论说的 WooYun: Discuz!全版本鸡肋CSRF漏洞一枚 ，由于crossdomain.xml配置不当，可能会导致一些问题。评论时只是有个基本的印象，没有实测，既然xsser说有对这个的防御，那来看看是怎么防的. crossdomain.xml的默认设置： 对dz的代码结构不熟，按黑盒来测。 首先是读取那个formhash，看来有了crossdomain.xml的帮助，很容易的读到了当前用户的formhash。 function gethash function getformhashtxt txt =...

Multiple Vulnerabilities in Cisco Wireless LAN Controllers (cisco-sa-20090727-wlc)

The remote Cisco Wireless LAN Controller WLC is affected by one or more of the following vulnerabilities: - Malformed HTTP or HTTPS authentication response Denial of Service CVE-2009-1164 - SSH connections Denial of Service CVE-2009-1165 - Crafted HTTP or HTTPS request Denial of Service...

Cisco Unified Communications Manager (CUCM) Web Detection

The web interface for Cisco Unified Communications Manager CUCM was detected. Note: This plugin does not report anything. It only collects version information to be used downstream. C Tenable, Inc. include'compat.inc'; if description scriptid70088; scriptversion"1.9";...

Cisco IronPort PostX < 6.2.9.1 Multiple Vulnerabilities

The version of Cisco IronPort PostX on the remote device is a version prior to 6.2.9.1. As such, it is affected by multiple vulnerabilities : - An unspecified vulnerability in the administrative interface in the embedded HTTPS server allows remote attackers to read arbitrary files via unknown...

Facebook Android Bug Sent Users' Photos in the Clear

A researcher has discovered a privacy bug in the Facebook Android app that enables an attacker to view and download any images that a user sends to Facebook. The problem derives from the fact that the app, along with the official Facebook Messenger app for Android, don’t send those images over...

Debian Security Advisory DSA 2457-2 (iceweasel - several vulnerabilities)

Several vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox. The included XULRunner library provides rendering services for several other applications included in Debian. CVE-2012-0467Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall,...

BEAST Cryptographic Attack Mitigations Overturned

The BEAST cryptographic attack, once thought to be largely mitigated, has two things conspiring against it to make breaches potentially possible again. Not only has a server-side mitigation essentially been rendered moot by recent research into the RC4 cryptographic protocol, but Apple has yet to...

Frequently Unanswered Questions on the NSA Leaks

The flood of documents regarding the NSA’s collection methods and capabilities that have been leaked this summer has produced thousands of news stories and several metric tons of speculation about what it all means. But for all of the postulating, analysis and reporting, there are still a lot of...

HTTP Cookie 'secure' Property Transport Mismatch

The remote web server sends out cookies to clients with a 'secure' property that does not match the transport, HTTP or HTTPS, over which they were received. This may occur in two forms : 1. The cookie is sent over HTTP, but has the 'secure' property set, indicating that it should only be sent ove...

Moderate: Red Hat Security Advisory: rubygems security update

An updated rubygems package that fixes two security issues is now available for Red Hat OpenShift Enterprise 1.2.2. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Amazon Linux AMI : rubygems (ALAS-2012-79)

RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amaz...

Amazon Linux AMI : ca-certificates (ALAS-2011-03)

This update includes the latest updates to the root Certificate Authority list from Mozilla. It was found that a Certificate Authority CA issued fraudulent HTTPS certificates. This update removes that CA's root certificate from the ca-certificates package, rendering any HTTPS certificates signed ...

Amazon Linux AMI : perl-libwww-perl (ALAS-2011-17)

The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...