Apple Mac OS X不安全身份验证漏洞(CVE-2013-5181)

BUGTRAQ ID: 63350 CVECAN ID: CVE-2013-5181 OS X（前称Mac OS X）是苹果公司为麦金塔电脑开发的专属操作系统的最新版本。 OS X 10.9之前版本“邮件”的自动配置功能内存在安全漏洞，对于支持CRAM-MD5身份验证的服务器选择了纯文本身份验证，可使远程攻击者通过嗅探网络，获取敏感信息。 0 Apple Mac OS X 10.9 厂商补丁： Apple ----- Apple已经为此发布了一个安全公告（msg00004）以及相应补丁: msg00004：APPLE-SA-2013-10-22-3 OS X Mavericks v10....

ALPINE-CVE-2013-4122

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service thread crash and consumption via 1 an invalid salt or, when FIPS-140...

CVE-2013-4122

CVE-2013-4122 affects Cyrus SASL 2.1.23, 2.1.26 and earlier. The root cause is incorrect handling of when a NULL value is returned on error by the crypt function in glibc 2.17+, enabling remote DoS via (1) invalid salt or (2) DES or (3) MD5 passwords when FIPS-140 is enabled, triggering a NULL po...

CVE-2013-4122

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service thread crash and consumption via 1 an invalid salt or, when FIPS-140...

Threat Outbreak Alert: Email Messages with Malicious Attachments on December 24, 2013

Medium Alert ID: 31483 First Published: 2013 October 24 17:34 GMT Last Updated: 2013 December 24 16:39 GMT Version: 14 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an attachment for the recipient. The text in the email message...

Threat Outbreak Alert: Email Messages with Malicious Attachments on October 24, 2013

Medium Alert ID: 31485 First Published: 2013 October 24 14:47 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an attachment for the recipient. The text in the email message attempts to convince the recipient to open the...

Authentication flaw

The auto-configuration feature in Mail in Apple Mac OS X before 10.9 selects plaintext authentication for unspecified servers that support CRAM-MD5 authentication, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2013-5181

Apple Mac OS X Mail’s auto-configuration (pre-10.9) may select plaintext authentication for servers that support CRAM-MD5, enabling remote sniffing of credentials. Affected: OS X Mail before 10.9. Root cause: plaintext auth chosen during auto-config. Impact: potential exposure of sensitive inform...

CVE-2013-5181: Undefined Security Weakness

The auto-configuration feature in Mail in Apple Mac OS X before 10.9 selects plaintext authentication for unspecified servers that support CRAM-MD5 authentication, which allows remote attackers to obtain sensitive information by sniffing the network...

Threat Outbreak Alert: Email Messages with Malicious Attachments on October 22, 2013

Medium Alert ID: 31423 First Published: 2013 October 22 19:42 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that contain a malicious attachment for the recipient. The text in the email message attempts to convince the recipient to open the...

Threat Outbreak Alert: Email Messages with Malicious Attachments on October 18, 2013

Medium Alert ID: 31371 First Published: 2013 October 21 14:53 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages with blank message body and files attached for the recipient. The .rar attachment contains a malicious .exe file that, when executed...

Threat Outbreak Alert: Fake Payment Information Email Messages on October 20, 2013

Medium Alert ID: 31375 First Published: 2013 October 21 14:33 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain payment details for the recipient. The text in the email message attempts to convince the recipient to open th...

Threat Outbreak Alert: Fake Picture Sharing Email Messages on October 17, 2013

Medium Alert ID: 31327 First Published: 2013 October 17 18:04 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam email messages that claim to contain a personal photo for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Court Application Document Email Messages on October 16, 2013

Medium Alert ID: 31317 First Published: 2013 October 17 14:28 GMT Version: 1 Summary Cisco Security has detected significant activity related to German-language spam email messages that claim to contain a court application for the recipient. The text in the email message attempts to convince the...

Woltlab Burning Board Regenbogenwiese 2007 Addon - SQL Injection

Exploit Title: Woltlab Burning Board Regenbogenwiese 2007 Addon SQL Injection Exploit Google Dork: inurl:regenbogenwiese.php wbb and more Date: 04.09.2013 Exploit Author: Easy Laster Software Name: Regenbogenwiese v1.5 © 2007 by DieKrabbe Version: 1.5 Tested on: Windows 8/Backtrack !/usr/bin/ruby...

Threat Outbreak Alert: Email Messages with Malicious Attachments on October 14, 2013

Medium Alert ID: 31260 First Published: 2013 October 15 15:09 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages with a blank message body. However, the .rar attachment contains a malicious .exe file that, when executed, attempts to infect the...

Imperva SecureSphere Web Application Firewall MX 9.5.6 - Blind SQL Injection

Blind SQL Injection to Imperva SecureSphere Web Application Firewall MX ======================================================================= ADVISORY INFORMATION Title: Blind SQL Injection on Imperva SecureSphere Web Application Firewall MX Discovery date: 09/04/2013 Release date: 09/10/2013...

Imperva SecureSphere Web Application Firewall MX 9.5.6 - Blind SQL Injection

The management console of Imperva WAF allows an authenticated user having the only privilege to view lookup dataset, to perform a privilege escalation, and extract through a blind sql injection, the MD5 hash of Administrator's account on the console. Blind SQL Injection to Imperva SecureSphere We...

Imperva SecureSphere Web Application Firewall MX 9.5.6 - Blind SQL Injection

Imperva SecureSphere Web Application Firewall MX 9.5.6 - Blind SQL Injection Blind SQL Injection to Imperva SecureSphere Web Application Firewall MX ======================================================================= ADVISORY INFORMATION Title: Blind SQL Injection on Imperva SecureSphere Web...

Threat Outbreak Alert: Email Messages with Malicious Attachments on October 9, 2013

Medium Alert ID: 31190 First Published: 2013 October 9 20:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an attachment relating to an invoice for the recipient. The email message attempts to convince the recipient to...