12506 matches found
CVE-2013-4852
CVE-2013-4852 describes an integer overflow in PuTTY (0.62 and earlier) and in dependent products (e.g., WinSCP
CVE-2013-4206
Heap-based buffer underflow in the modmul function in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service crash and possibly trigger memory corruption or code execution via a crafted DSA signature, which is not properly handled when performing certain bit-shifting...
CVE-2013-4207
Buffer overflow in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service crash via an invalid DSA signature that is not properly handled during computation of a modular inverse and triggers the overflow during a division by zero by the bignum functionality, a differe...
[SECURITY] Fedora 19 Update: openstack-swift-1.8.0-3.fc19
OpenStack Object Storage Swift aggregates commodity servers to work toget her in clusters for reliable, redundant, and large-scale storage of static obje cts. Objects are written to multiple hardware devices in the data center, with t he OpenStack software responsible for ensuring data replicatio...
Design/Logic Flaw
The ssl.matchhostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate...
CVE-2013-4248
The opensslx509parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL...
CVE-2013-4238
CVE-2013-4238 concerns the Python ssl.match_hostname handling of NULL characters in a domain name within the SAN of an X.509 certificate. Public sources in the initial and connected documents confirm that this flaw could enable MITM spoofing of SSL servers when certificates from trusted CAs are u...
DSA-2738-1 ruby1.9.1 - several
Bulletin has no description...
CVE-2013-4248
The opensslx509parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL...
Microsoft to Eliminate Weak MD5 Crypto Algorithm
The clock is running on Windows administrators to sweep out MD5 implementations before a February 2014 patch from Microsoft slams the door shut on the broken, aged crypto algorithm. Microsoft released a pair of advisories yesterday in addition to its regular Patch Tuesday security updates alertin...
NHTSA Website Back Online After Hack
The National Highway Traffic Safety Administration restored its servers yesterday, 10 days after an attack knocked the agency’s website offline. The government agency confirmed last Tuesday that 10 of its servers had been hacked in early August after it received an alert from the United States...
August 2013 Microsoft Patch Tuesday Security Updates
Microsoft took less than a month to incorporate an Oracle Outside In patch and fix a critically rated remote code execution bug in Exchange Servers. The Microsoft patch is among three critical bulletins—eight overall—released today as part of its August 2013 Patch Tuesday security updates. Oracle...
Debian Security Advisory DSA 2737-1 (swift - several vulnerabilities)
Several vulnerabilities have been discovered in Swift, the Openstack object storage. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-2161 Alex Gaynor from Rackspace reported a vulnerability in XML handling within Swift account servers. Account strings...
Web Servers Malicious HTTP Request Directory Traversal (CVE-2005-3299; CVE-2014-7174; CVE-2022-1476; CVE-2022-29806)
There exists a directory traversal vulnerability On different web servers. The vulnerability is due to an input validation error in a web server that does not properly sanitize the parameters in request body for the directory traversal patterns. Successful exploitation allows unauthenticated remo...
CVE-2013-4037
The RAKP protocol support in the Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers sends a password hash to the client, which makes i...
CVE-2013-4038
The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information by reading...
Design/Logic Flaw
The RAKP protocol support in the Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers sends a password hash to the client, which makes i...
CVE-2013-4038
The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information by reading...
CVE-2013-4031
The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers has a default password for the IPMI user account, which makes it easier for...
CVE-2013-4037
The CVE-2013-4037 issue concerns the RAKP-based authentication in IPMI on IBM/Lenovo IMM and IMM2 (various BladeCenter, Flex System, System x IMM/IMM2 platforms). The RAKP flow transmits a password hash to the client, enabling offline brute‑force/dictionary attacks to recover credentials. IBM’s a...