440 matches found
Looking to Bolster Security, Dropbox Adds Two-Factor Authentication
Several weeks after announcing that some of its users’ log-ins and passwords had been stolen, file storage company Dropbox announced it has added a two-step authentication process over the weekend to help reinforce the security of its users’ accounts. The added layer of security is currently...
UBUNTU-CVE-2012-3392
mod/forum/unsubscribeall.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not consider whether a forum is optional, which allows remote authenticated users to bypass forum-subscription requirements by leveraging the student role and unsubscribing from all forums...
Family CMS 2.9 - Multiple Vulnerabilities
Family CMS 2.9 and earlier multiple Vulnerabilities =================================================================================== Exploit Title: Family CMS 2.9 and earlier multiple Vulnerabilities Download link...
[SECURITY] Fedora 14 Update: pure-ftpd-1.0.32-1.fc14
Pure-FTPd is a fast, production-quality, standard-comformant FTP server, based upon Troll-FTPd. Unlike other popular FTP servers, it has no known security flaw, it is really trivial to set up and it is especially designed for modern Linux and FreeBSD kernels setfsuid, sendfile, capabilities...
[SECURITY] Fedora 14 Update: whatsup-1.12-1.fc14
Whatsup is a cluster node up/down detection utility. Whatsup can quickly calculate and output the up and down nodes of a cluster. Whatsup allows some tools, such as Pdsh, to operate more quickly by not operating on down nodes. Whatsup calculates the up and down nodes of a cluster through one of...
Design/Logic Flaw
Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit JDK before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to...
CVE-2009-1190
Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit JDK before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to...
SNMP Version 3 Authentication Vulnerabilities
Multiple Cisco products contain either of two authentication vulnerabilities in the Simple Network Management Protocol version 3 SNMPv3 feature. These vulnerabilities can be exploited when processing a malformed SNMPv3 message. These vulnerabilities could allow the disclosure of network informati...
HP-UX 11i (swask) Format String Local Root Exploit
No description provided by source. / HP-UX swask format string local root exploit ============================================ HP-UX 'swask' contains an exploitable format string vulnerability. The 'swask' utility is installed setuid root by default. Specifically the vulnerability is in the...
security flaw
sslenginekernel.c in modssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions...
mod_ssl
New modssl packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, and -current to fix a security issue. If "SSLVerifyClient optional" was configured in the global section of the config file, it could improperly override "SSLVerifyClient require" in a per-location section. More details...
libpam-ldap authentication bypass
Result of an attempt to authenticate against an LDAP server that does not set an optional data field is ignored...
Apache-SSL optional client certificate vulnerability
From the Apache-SSL security advisory: If configured with SSLVerifyClient set to 1 or 3 client certificates optional and SSLFakeBasicAuth, Apache-SSL 1.3.28+1.52 and all earlier versions would permit a client to use real basic authentication to forge a client certificate. All the attacker needed ...
CVE-2003-1031
Cross-site scripting XSS vulnerability in register.php for vBulletin 3.0 Beta 2 allows remote attackers to inject arbitrary HTML or web script via optional fields such as 1 "Interests-Hobbies", 2 "Biography", or 3 "Occupation."...
Microsoft BizTalk Server 2002 - HTTP Receiver Buffer Overflow
Microsoft BizTalk Server 2002 - HTTP Receiver Buffer Overflow source: https://www.securityfocus.com/bid/7469/info Microsoft BizTalk Server 2002 contains a boundary condition error that could allow a buffer to be overrun. Successful exploitation could allow arbitrary code execution in the security...
Microsoft BizTalk Server 2002 - HTTP Receiver Buffer Overflow
source: https://www.securityfocus.com/bid/7469/info Microsoft BizTalk Server 2002 contains a boundary condition error that could allow a buffer to be overrun. Successful exploitation could allow arbitrary code execution in the security context of the IIS Server hosting the application. It is...
Detectoid for 929735 -- targetting specific locales
Certain locales will receive this update as a Recommended/AU update and the rest of the locales will be offered the update as an Optional/Non-AU update...
Update to support copying .mkv files to Windows Phone from a computer that is running Windows
None None...