OpenSSL 1.0.1 < 1.0.1k Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.1k. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.1k advisory. - Memory leak in the dtls1bufferrecord function in d1pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote...

CVE-2014-8151

The darwinsslconnectstep1 function in lib/vtls/curldarwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL aka SecureTransport back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to...

CVE-2014-8639

Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 aka Proxy Authentication Required status code, which allows remote HTTP proxy servers to conduct session...

CVE-2014-8639

Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 aka Proxy Authentication Required status code, which allows remote HTTP proxy servers to conduct session...

FBI Director: 'High Confidence' in North Korea Attribution

When the FBI publicly announced that the North Korean regime was responsible for an embarrassing compromise of corporate networks at Sony Pictures Entertainment, security experts remained skeptical. FBI Director James Comey doubled down on the assertion yesterday at the Fordham University...

CVE-2015-0204

The ssl3getkeyexchange function in s3clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORTRSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to...

Ruby on Rails: Denial of Service in Action Pack Exception Handling

Severity Medium Impact Attackers can cause an application to be unreachable, causing a denial of service condition. Details When a Rails application receives a request with either body or query parameters, these parameters are converted to a params hash. Hashes can be passed to the application in...

Multiple Web Servers Archived Link Information Disclosure

An information disclosure vulnerability has been reported in some Linux servers. By uploading a specially crafted compressed archive file a remote attacker may leverage this vulnerability to gain access to sensitive information. Successful exploitation will allow the attacker to gain access to...

Openwall 3.1 Released With Fixes for Shellshock, POODLE Attack

The maintainers of the Openwall security enhanced Linux distribution have released a new stable version, which includes fixes for a number of serious vulnerabilities, such as the Shellshock Bash bug and the flaw in SSLv3 that leads to the POODLE attack. Openwall is designed to be a small, compact...

CVE-2014-9458: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the GDB debugger module in Hex-Rays IDA Pro before 6.6 cumulative fix 2014-12-24 allows remote GDB servers to have unspecified impact via unknown vectors...

CVE-2014-8155

GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is 1 not yet valid or 2 no longer valid...

[SECURITY] Fedora 19 Update: mediawiki-1.23.8-1.fc19

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

[SECURITY] Fedora 20 Update: mediawiki-1.23.8-1.fc20

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

[CVE-2014-7807] Apache CloudStack unauthenticated LDAP binds

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CVE-2014-7807: Apache CloudStack unauthenticated LDAP binds CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P Vendors: The Apache Software Foundation Citrix, Inc. Versions Afffected: Apache CloudStack 4.3, 4.4 Description: Apache CloudStack may be configured to...

Multiple Web Servers Webdav rootkit Backdoor Command Execution

A command execution vulnerability has been reported in multiple Web servers. The vulnerability is due to the existence of a backdoor file on the Web server within a specific library. A remote attacker can exploit this vulnerability by sending a request to the malicious backdoor file...

Multiple Products Directory Server LDAP Buffer Overflows - Ver2 (CVE-2006-0717)

An error was found in the way several LDAP servers from several vendors handle malformed LDAP requests. This can be exploited to crash the service via a specially-crafted request sent to the LDAP server port...

CA ARCserve Backup DB Engine Denial of Service - Ver2 (CVE-2008-4399)

CA ARCserve Backup products offer data protection for distributed servers, clients,databases and applications. They provide centralized control over a series of distributed operationsincluding Backup and Restore, Data Migration, and Threat Management. There exists a denial of service vulnerabilit...

Updated smack packages fix security vulnerabilities

Updated smack packages fix security vulnerabilities: The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers...

PsychoStats < 2.2.4 Beta - Cross Site Scripting

PsychoStats Cross Site Scripting Vendor: Jason Morriss Product: PsychoStats Version: = 2.2.4 Beta Website: http://www.psychostats.com/ BID: 12089 CVE: CVE-2004-1417 OSVDB: 12560 SECUNIA: 13619 PACKETSTORM: 35502 Description: PsychoStats is a statistics generator for games. Currently there is...

Multiple Web Servers king injector Backdoor Command Execution

A command execution vulnerability has been reported in multiple Web servers. The vulnerability is due to the existence of a backdoor file on the Web server within a specific library. A remote attacker can exploit this vulnerability by sending a request to the malicious backdoor file...