Wemux 'Send()'函数安全绕过漏洞

Bugtraq ID:66234 wemux是一个多用户终端复用工具。 wemux "Send"函数存在错误，允许攻击者利用漏洞绕过安全限制在只读受限的会话中发送命令。 0 wemux 3.x wemux 3.2.0已经修复该漏洞，建议用户下载更新： https://github.com/zolrath/wemux...

AIX 6.1 TL 6 : bos.net.tcp.client (U849877)

The remote host is missing AIX PTF U849877, which is related to the security of the package bos.net.tcp.client. AIX could allow a remote attacker to cause a denial of service, caused by an error when the TCP large send offload option is enabled on a network interface. By sending a specially craft...

AIX 7.1 TL 1 : bos.net.tcp.client (U849490)

The remote host is missing AIX PTF U849490, which is related to the security of the package bos.net.tcp.client. AIX could allow a remote attacker to cause a denial of service, caused by an error when the TCP large send offload option is enabled on a network interface. By sending a specially craft...

AIX 6.1 TL 7 : bos.net.tcp.client (U848193)

The remote host is missing AIX PTF U848193, which is related to the security of the package bos.net.tcp.client. AIX could allow a remote attacker to cause a denial of service, caused by an error when the TCP large send offload option is enabled on a network interface. By sending a specially craft...

CVE-2014-1694

Multiple cross-site request forgery CSRF vulnerabilities in 1 CustomerPreferences.pm, 2 CustomerTicketMessage.pm, 3 CustomerTicketProcess.pm, and 4 CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow...

DEBIAN-CVE-2014-1694

Multiple cross-site request forgery CSRF vulnerabilities in 1 CustomerPreferences.pm, 2 CustomerTicketMessage.pm, 3 CustomerTicketProcess.pm, and 4 CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow...

SimplyShare 1.4 Code Execution / Local File Inclusion / XSS

Document Title: =============== SimplyShare v1.4 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1181 Release Date: ============= 2014-01-28 Vulnerability Laboratory ID VL-ID: ==================================== 1181...

Directory traversal

Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2.1 and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056...

CVE-2014-0666: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2.1 and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056...

PayPal.com | Send Money Stored XSS Vulnerability

This vulnerability allows steal money, cookies, infection with exploit-pack and much, much more. If the user go to the "Send Money" tab, then vulnerability is exploited. The vulnerability has not been reported to PayPal Sec-Team. PayPal developers possibly do not know about its existence. This is...

Android Vulnerability Bypasses App's Digital Signature

A vulnerability exists in the Android code base that would allow a hacker to modify a legitimate, digitally signed Android application package file APK and not break the app’s cryptographic signature—an action that would normally set off a red flag that something is amiss. Researchers at startup...

imacs CMS 0.3.0 Shell Upload

?php / ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / \ / / XXXXXX /\ / XXXXXX / / XXXXXX / ------' Exploit Title : imacs CMS Unrestricted File Upload Exploit Date...

UBUNTU-CVE-2013-2081

Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data...

CVE-2013-0308

The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2013-0308

The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2013-0308

The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2013-0308

CVE-2013-0308 affects the git tool’s imap-send command: prior to version 1.8.1.4, it does not verify that the SSL server hostname matches the certificate’s CN/subjectAltName, enabling MITM spoofing with any valid cert. Affected releases include git versions before 1.8.1.4; multiple advisories (e....

CVE-2013-0308

The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2013-0308: Improper Input Validation

The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

git: Incorrect IMAP server's SSL x509.v3 certificate validation in git-imap-send command

The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...