Memory corruption

Off-by-one error in the danerawtlsa in the DANE library libdane in GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6 allows remote servers to cause a denial of service memory corruption via a response with more than four DANE entries. NOTE: this issue is due to an incomplete fix for CVE-2013-4466...

[OMENS v1.17] The framework for distributing Actionable Intelligence

OMENS Object Monitor for Enhanced Network Security was born out of the intrusion and intrusion attempts analysis that I have been doing over many years. I consistently run into intrusion attempts that existing IDS systems have difficulty detecting. OMENS is my attempt to better detect and...

IT-Grundschutz M4.227: Einsatz eines lokalen NTP-Servers zur Zeitsynchronisation (Windows)

IT-Grundschutz M4.227: Einsatz eines lokalen NTP-Servers zur Zeitsynchronisation Windows. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94219 Stand: 13...

IT-Grundschutz M4.227: Einsatz eines lokalen NTP-Servers zur Zeitsynchronisation - Windows

IT-Grundschutz M4.227: Einsatz eines lokalen NTP-Servers zur Zeitsynchronisation Windows. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94219 Stand: 13...

CVE-2013-4487

GnuTLS libdane contains an off-by-one in dane_raw_tlsa that can cause memory corruption/DoS when a DNS response includes more than four DANE entries. Affected: GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6; root cause tied to incomplete fix for CVE-2013-4466. Remediation: upgrade to 3.1.16 or...

CVE-2013-4466

Buffer overflow in the danequerytlsa function in the DANE library libdane in GnuTLS 3.1.x before 3.1.15 and 3.2.x before 3.2.5 allows remote servers to cause a denial of service memory corruption via a response with more than four DANE entries...

JBoss AS Attacks Up Since Exploit Code Disclosed

Attackers are exploiting a two-year-old vulnerability in JBoss Application Servers that enables a hacker to remotely get a shell on a vulnerable webserver. The number of infections has surged since exploit code called pwn.jsp was publicly disclosed Oct. 4. Researchers at Imperva said that a numbe...

CVE-2013-4510

Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report...

Directory traversal

Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report...

PYSEC-2013-28

Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report...

CVE-2013-4510

Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report...

CVE-2013-4510

Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report...

CVE-2013-4510

CVE-2013-4510 describes a directory traversal vulnerability in the Tryton client (3.0.0, prior to 20131104) that allows a remote server to write arbitrary files via path separators in the extension of a report. The issue is documented across multiple sources (including GHSA and OSV entries) with ...

CVE-2013-4510

Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report...

Amazon Linux AMI : python26 (ALAS-2013-241)

It was discovered that multiple Python standard library modules implementing network protocols such as httplib or smtplib failed to restrict sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory. CVE-2013-1752...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.2 Extended Update Support. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, whi...

CVE-2013-6628

net/socket/sslclientsocketnss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by...

CVE-2013-6628

net/socket/sslclientsocketnss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by...

[SECURITY] Fedora 20 Update: openstack-glance-2013.2-1.fc20

OpenStack Image Service code-named Glance provides discovery, registratio n, and delivery services for virtual disk images. The Image Service API server provides a standard REST interface for querying information about virtual d isk images stored in a variety of back-end stores, including OpenSta...

TP-Link Cross Site Request Forgery Vulnerability

This write up goes into detail about how real world cross site request forgery attacks can be used to hijack DNS on TP-Link routers. I. Introduction Today the majority of wired Internet connections is used with an embedded NAT router, which allows using the same Internet connection with several...