Prosody mod_dialback module spoofing vulnerability

Prosody is a set of Jabber/XMPP communication server software written in Lua. Prosody's moddialback module fails to correctly generate random numbers for the server-to-server dialback authentication secret token, allowing remote attackers to spoof the server by performing a brute-force attack...

CVE-2016-1232

The moddialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack...

DEBIAN-CVE-2016-1232

The moddialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack...

PT-2016-4657

Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.9.9 Description The issue concerns the mod dialback module, which does not properly generate random values for the secret token used in server-to-server dialback authentication. This weakness makes it easier for...

PT-2015-7946

Name of the Vulnerable Software and Affected Versions proftpd affected versions not specified Description The issue arises from the mod sftp module in proftpd, which lacks bounds or length limitations when reading SFTP extension key/value data from the network. This allows a malicious attacker to...

httpd: NULL pointer dereference in mod_cache if Content-Type has empty value

A NULL pointer dereference flaw was found in the way the modcache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled...

httpd: bypass of mod_headers rules via chunked requests

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header...

httpd: NULL pointer dereference in mod_cache if Content-Type has empty value

A NULL pointer dereference flaw was found in the way the modcache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled...

httpd: NULL pointer dereference in mod_cache if Content-Type has empty value

A NULL pointer dereference flaw was found in the way the modcache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled...

httpd: bypass of mod_headers rules via chunked requests

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header...

PT-2015-3232

Name of the Vulnerable Software and Affected Versions Apache Subversion versions 1.7.x through 1.8.14 Apache Subversion versions 1.9.x through 1.9.2 Description The issue is caused by an integer overflow in mod dav svn, a component of the centralized version control system Apache Subversion. This...

UBUNTU-CVE-2015-5343

Integer overflow in util.c in moddavsvn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service subversion server crash or memory consumption and possibly execute arbitrary code via a skel-encoded request body, which...

Mac OS X 10.11.x < 10.11.2 Multiple Vulnerabilities

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.2. It is, therefore, affected by multiple vulnerabilities in the following components : - apachemodphp - AppSandbox - Bluetooth - CFNetwork HTTPProtocol - Compression - Configuration Profiles - CoreGraphics - CoreMedi...

PT-2016-1304

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.6.11 Moodle versions 2.7.x before 2.7.11 Moodle versions 2.8.x before 2.8.9 Moodle versions 2.9.x before 2.9.3 Description The issue is related to multiple cross-site request forgery CSRF vulnerabilities in the lesso...

PT-2016-1307

Name of the Vulnerable Software and Affected Versions Moodle versions 2.6.11 and earlier, 2.7.x through 2.7.10, 2.8.x through 2.8.8, 2.9.x through 2.9.2 Description The issue is related to the mod scorm component in Moodle, which mishandles availability dates. This allows remote authenticated use...

PT-2015-3386

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2 through 1.0.2e Description The Montgomery squaring implementation in crypto/bn/asm/x86 64-mont5.pl mishandles carry propagation and produces incorrect output, making it easier for remote attackers to obtain sensitive...

PT-2015-7634

Name of the Vulnerable Software and Affected Versions Xen versions 3.4 through 4.6.x Description The issue arises from the mod l2 entry function in arch/x86/mm.c, which fails to properly validate level 2 page table entries. This allows local PV guest administrators to gain privileges by creating ...

Mac OS X < 10.11 Multiple Vulnerabilities (GHOST)

The remote host is running a version of Mac OS X that is 10.6.8 or later but prior to 10.11. It is, therefore, affected by multiple vulnerabilities in the following components : - Address Book - AirScan - apachemodphp - Apple Online Store Kit - AppleEvents - Audio - bash - Certificate Trust Polic...

Low: Red Hat Security Advisory: mod_proxy_fcgi and ceph security and bug fix update

Updated modproxyfcgi and ceph packages that fix one security issue and several bugs are now available for CentOS 6. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

PT-2015-4565

Name of the Vulnerable Software and Affected Versions mod cluster versions prior to 1.3.2.Alpha1 Description A cross-site scripting XSS issue exists in the manager web interface, allowing remote attackers to inject arbitrary web script or HTML via a crafted MCMP message. This could potentially le...