364 matches found
Google Chrome 0.2.149 - ftp:// URL Multiple File Format Handling XSS
No description provided by source. source: http://www.securityfocus.com/bid/31855/info Google Chrome 0.2.149 is prone to a cross-site scripting weakness that arises because the software fails to handle specially crafted files served using the FTP protocol. Successfully exploiting this issue may...
Sun Java System Access Manager <= 7.1 Username Enumeration Weakness
No description provided by source...
Jenkins HP Application Automation Tools Plugin Password Encryption Security Weakness
The remote host is using the Jenkins HP Application Automation tools plugin. Nessus was able to remotely access one or more unprotected files in the Jenkins build system and decrypt the HP Application Lifecycle Management password. These passwords are currently encrypted with a known, hard-coded...
stunnel < 5.00 PRNG State Security Weakness
The version of stunnel installed on the remote host is prior to version 5.00. It is, therefore, affected by a security weakness due to the PRNG state not being reset for new connections where the server forks. A remote attacker can exploit this issue to disclose sensitive information, such as the...
Modern Browser XSS Filter Evasion
Modern browsers usually have an antiXSS filter, that protects users from some of the consequences of this kind of attacks. Normally, they block cross site scripting execution, so the "injected" code normally, JavaScript or HTML is not executed inside victim's browser. Chrome calls this filter...
OpenEMR 4.1.1 Patch 14 SQL Injection / Shell Upload
Exploit Title: OpenEMR 4.1.1 Patch 14 Multiple Vulnerabilities Date: Sep 17 2013 Exploit Author: xistence Vendor Homepage: www.open-emr.org Tested on: CentOS 5.9 32-bit Affected Version : 4.1.1 Patch 14 and lower Fix: Upgrade to OpenEMR 4.1.2 Software details: OpenEMR is a Free and Open Source...
Fedora 18 : perl-Crypt-DSA-1.17-10.fc18 (2013-15755)
As taught by the '09 Debian PGP disaster relating to DSA, the randomness source is extremely important. On systems without /dev/random, Crypt::DSA falls back to using Data::Random. Data::Random uses rand, about which the perldoc says 'rand is not cryptographically secure. You should not rely on i...
Watchwatch-like Heartbeat Monitor to Replace Passwords
The heart beating in our chests contains in its right atrium a bundle of nerve cells and synapses known as the cardiac pacemaker. The cardiac pacemaker emits electrical impulses that cause the human heart to beat. These electrical impulses and the heart rhythm they produce can be measured by an...
Greenstone Multiple Vulnerabilities (Jun 2013) - Active Check
Greenstone is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
[Cain & Abel v4.9.44] Password recovery tool for Microsoft Operating Systems
Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords,...
[SE-2012-01] Yet another Reflection API flaw affecting Oracle's Java SE
Hello All, Today, a vulnerability report with an accompanying Proof of Concept code was sent to Oracle notifying the company of a new security weakness affecting Java SE 7 software. The new flaw was verified to affect all versions of Java SE 7 including the recently released 1.7.021-b11. It can b...
Mozilla Firefox - Cookie Verification Denial of Service
Mozilla Firefox - Cookie Verification Denial of Service source: https://www.securityfocus.com/bid/62969/info Mozilla Firefox is prone to a denial-of-service vulnerability because it fails to verify the user supplied input. Successfully exploiting this issue will allow an attacker to inject specia...
Mozilla Firefox - Cookie Verification Denial of Service
source: https://www.securityfocus.com/bid/62969/info Mozilla Firefox is prone to a denial-of-service vulnerability because it fails to verify the user supplied input. Successfully exploiting this issue will allow an attacker to inject special characters into the browser's local cookie storage,...
CentOS 5 : ipa-client (CESA-2013:0189)
An updated ipa-client package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...
Low Detection Rates Mar Google Android Application Verification Service
Google’s brand new application verification service for Android, released in JellyBean 4.2, fails to measure up to its commercial counterparts, according to researchers from North Carolina State University. The new service determines whether applications installed on Android devices are malicious...
Greenstone - Multiple Vulnerabilities
Greenstone - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/56662/info Greenstone is prone to the following security vulnerabilities: 1. A file-disclosure vulnerability 2. A cross-site scripting vulnerability 3. A security weakness 4. A security-bypass vulnerability Attackers...
Greenstone - Multiple Vulnerabilities
source: https://www.securityfocus.com/bid/56662/info Greenstone is prone to the following security vulnerabilities: 1. A file-disclosure vulnerability 2. A cross-site scripting vulnerability 3. A security weakness 4. A security-bypass vulnerability Attackers can exploit these issues to view local...
IBM WebSphere MQ 6.x < 6.0.2.9 / 7.x < 7.0.1.1 'userid' and 'password' Information Disclosure
The IBM WebSphere MQ server installed on the remote Windows host is version 6.x prior to 6.0.2.9 or version 7.x prior to 7.0.1.1. It is, therefore, affected by a security weakness where usernames and passwords are sent as cleartext in parameter fields, thus allowing a remote attacker to obtain...
Huawei (Multiple Products) - Password Encryption
source: https://www.securityfocus.com/bid/56510/info Multiple Huawei products are prone to a weak password encryption weakness. Successful exploits may allow an attacker to decrypt stored passwords; this may aid in further attacks. The following are vulnerable: Huawei Quidway series Huawei CX600...
Fixed in Apache Tomcat 5.5.36
Moderate: DIGEST authentication weakness CVE-2012-3439 Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved: 1. Tomcat tracked client rather than server nonces and nonce count. 2. When a session ID was present, authentication was bypassed. 3. The user...