Scientific Linux Security Update : nss on SL6.x i386/x86_64

A flaw was found in the way NSS matched SSL certificates when the certificates had a Common Name containing a wildcard and a partial IP address. NSS incorrectly accepted connections to IP addresses that fell within the SSL certificate's wildcard range as valid SSL connections, possibly allowing a...

DSA-2516-1 isc-dhcp - denial of service

Bulletin has no description...

New Mac Trojan Dropper Creates Backdoor, Survives Reboots

There’s a new Mac Trojan dropper that uses a silent installation process and it also has the ability to establish backdoor access to infected machines. Security researchers at Intego found samples of the OSX/Crisis malware on the Virus Total website, but it has not yet been found in the wild...

CVE-2011-4592

The command-line cron implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly interact with IP blocking, which might allow remote attackers to bypass intended IP address restrictions by leveraging a configuration in which IP blocking was disabled to restore cron...

Cross site request forgery (csrf)

The ipinrange function in mnet/lib.php in MNET in Moodle 1.9.x before 1.9.15 uses an incorrect data type, which allows remote attackers to bypass intended IP address restrictions via an XMLRPC request...

CVE-2011-4588

The ipinrange function in mnet/lib.php in MNET in Moodle 1.9.x before 1.9.15 uses an incorrect data type, which allows remote attackers to bypass intended IP address restrictions via an XMLRPC request...

App Store bypassed by Russian hacker without jailbreaking

Apple is investigating yet another security breach in its iTunes app store . A Russian hacker worked out a way that allows people to bypass payment in the App Store and download products for free. The hacker, dubbed ZonD80, posted a video of the crack on YouTube Deleted by Youtube now and claims...

Trojan Downloader Determines OS, Infects Systems With Custom Malware

A new downloader uncovered by researchers at the Finnish security firm F-Secure is capable of sniffing out which operating system a user is running and infecting them with a custom malicious payload. F-Secure’s Karmina Aquino discovered the attack on a compromised Colombian transport website. The...

FreeBSD : puppet -- multiple vulnerabilities (3a6960ef-c8a8-11e1-9924-001fd0af1a4c)

puppet -- multiple vulnerabilities Arbitrary file read on the puppet master from authenticated clients high. It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the maste...

BlackHole Exploit Kit Gets New Domain-Generation Algorithm

Nothing is more frustrating than spending days or weeks compromising dozens of Web sites and setting up your network of malicious redirects and then finding out that someone has screwed it all up by taking down one of your infected sites. Luckily, the crew behind the BlackHole exploit kit has...

CVE-2010-5076

QSslSocket in Qt before 4.7.0-rc1 recognizes a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority...

Fedora Update for mosh FEDORA-2012-9414

Check for the Version of mosh OpenVAS Vulnerability Test Fedora Update for mosh FEDORA-2012-9414 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

LLMNR Spoofer

LLMNR Link-local Multicast Name Resolution is the successor of NetBIOS Windows Vista and up and is used to resolve the names of neighboring computers. This module forges LLMNR responses by listening for LLMNR requests sent to the LLMNR multicast address 224.0.0.252 and responding with a...

Cisco Patches Vulnerabilities in VPN Client, ACE Product

Cisco warned customers Wednesday of several vulnerabilities in its AnyConnect Secure Mobility virtual private network VPN client, claiming that if not patched, the VPN software could be exploited by a remote attacker. The holes are present in versions of Cisco’s VPN client for Microsoft’s Windows...

CVE-2012-3063

Cisco Application Control Engine ACE before A42.3 and A5 before A51.1, when multicontext mode is enabled, does not properly share a management IP address among multiple contexts, which allows remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances...

Design/Logic Flaw

Cisco Application Control Engine ACE before A42.3 and A5 before A51.1, when multicontext mode is enabled, does not properly share a management IP address among multiple contexts, which allows remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances...

Cisco Application Control Engine Administrator IP Address Overlap Vulnerability

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

CVE-2012-2372

The rdsibxmit function in net/rds/ibsend.c in the Reliable Datagram Sockets RDS protocol implementation in the Linux kernel 3.7.4 and earlier allows local users to cause a denial of service BUGON and kernel panic by establishing an RDS connection with the source IP address equal to the IPoIB...

UBUNTU-CVE-2012-2372

The rdsibxmit function in net/rds/ibsend.c in the Reliable Datagram Sockets RDS protocol implementation in the Linux kernel 3.7.4 and earlier allows local users to cause a denial of service BUGON and kernel panic by establishing an RDS connection with the source IP address equal to the IPoIB...

MySQL - Authentication Bypass

MySQL - Authentication Bypass !/usr/bin/python This has to be the easiest "exploit" ever. Seriously. Embarassed to submit this a little. Title: MySQL Remote Root Authentication Bypass Written by: Dave Kennedy ReL1K http://www.secmaniac.com Original advisory here: seclists.org/oss-sec/2012/q2/493...