4471 matches found
openSUSE 10 Security Update : mono-core (mono-core-2182)
The Mono System.Xml.Serialization class contained a /tmp race which allows local attackers to potentially execute code as the user using the Serialization method. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSU...
php session extension information leak
The phpbinary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information memory contents via a serialized variable entry with a large length value, which triggers a buffer over-read...
CVE-2007-1380
The phpbinary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information memory contents via a serialized variable entry with a large length value, which triggers a buffer over-read...
CVE-2007-1380
The phpbinary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information memory contents via a serialized variable entry with a large length value, which triggers a buffer over-read...
CVE-2007-1380
Technical details about CVE-2007-1380 are not publicly available in the provided connected documents. The initial description mentions a buffer over-read in php_binary serialization within PHP session handling, but no vendor/version/impact/fix specifics are given here. Monitor for updates.
php session extension information leak
The phpbinary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information memory contents via a serialized variable entry with a large length value, which triggers a buffer over-read...
php session extension information leak
The phpbinary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information memory contents via a serialized variable entry with a large length value, which triggers a buffer over-read...
php session extension information leak
The phpbinary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information memory contents via a serialized variable entry with a large length value, which triggers a buffer over-read...
Critical: Red Hat Security Advisory: java-1.5.0-ibm security update
java-1.5.0-ibm packages that correct several security issues are available for Red Hat Enterprise Linux 4 Extras. This update has been rated as having critical security impact by the Red Hat Security Response Team. IBM's 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM...
security flaw
Multiple unspecified vulnerabilities in Sun Java Development Kit JDK and Java Runtime Environment JRE 5.0 Update 7 and earlier, and Java System Development Kit SDK and JRE 1.4.212 and earlier 1.4.x versions, allow attackers to develop Java applets or applications that are able to gain privileges,...
Critical: Red Hat Security Advisory: java-1.4.2-ibm security update
Updated java-1.4.2-ibm packages to correct several security issues are now available for Red Hat Enterprise Linux 3 and 4 Extras. This update has been rated as having critical security impact by the Red Hat Security Response Team. IBM's 1.4.2 SR7 Java release includes the IBM Java 2 Runtime...
security flaw
Multiple unspecified vulnerabilities in Sun Java Development Kit JDK and Java Runtime Environment JRE 5.0 Update 7 and earlier, and Java System Development Kit SDK and JRE 1.4.212 and earlier 1.4.x versions, allow attackers to develop Java applets or applications that are able to gain privileges,...
CVE-2006-6745
Multiple unspecified vulnerabilities in Sun Java Development Kit JDK and Java Runtime Environment JRE 5.0 Update 7 and earlier, and Java System Development Kit SDK and JRE 1.4.212 and earlier 1.4.x versions, allow attackers to develop Java applets or applications that are able to gain privileges,...
CVE-2006-6745
Multiple unspecified vulnerabilities in Sun Java Development Kit JDK and Java Runtime Environment JRE 5.0 Update 7 and earlier, and Java System Development Kit SDK and JRE 1.4.212 and earlier 1.4.x versions, allow attackers to develop Java applets or applications that are able to gain privileges,...
Sun Java运行时环境多个远程权限提升漏洞
Sun的Java运行时环境（JRE）为JAVA应用程序提供可靠的运行环境。 Java运行时环境中存在两个序列化相关的漏洞，可能允许不可信任的Applet或应用程序提升权限。 Sun JRE = 5.0 Update 7 Sun SDK = 1.4.212 Sun已经为此发布了一个安全公告（Sun-Alert-102731）以及相应补丁: Sun-Alert-102731：Security Vulnerabilities Related to Serialization in the Java Runtime Environment may Allow Untrusted Applets ...
CVE-2006-6017
WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service application crash via a string that represents a 1 malformed or 2 large serialized object, because the object...
Sending multipart/form-data requests from Flash (with arbitrary headers)
Hello lists, In my original "Forging HTTP request headers with Flash" paper http://www.securityfocus.com/archive/1/441014, I mentioned forcing multipart/form-data input format to ensure that Flash's LoadVars isn't used to forge the request. However, there's a work-around for the attacker - using...
[Full-disclosure] ASP.NET RCP/Encoded Web service DOS
ASP.NET RCP/Encoded Web service DOS http://www.spidynamics.com/spilabs/advisories/aspRCP.html Release Date: July 11, 2005 Severity: High System Affected IIS Servers exposing ASP.NET Web services that consume arrays in RCP/Encoded mode Applications using System.Xml.Serialization to consume untrust...