11330 matches found
CVE-2010-1851
Google Chrome, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related to a "cross-site data leakage"...
CVE-2010-1852
Microsoft Internet Explorer, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related to a "cross-site...
CVE-2010-1851
CVE-2010-1851 affects Google Chrome with the Invisible Hand extension enabled. The issue stems from cookies being used during background HTTP requests, which could enable remote servers to correlate requests and identify specific users and their product searches through HTTP request logging, desc...
DNSSEC Now on All Root Servers
Yesterday Wednesday the last of the 13 authoritative root servers for the domain name system switched over to the DNS Security Extensions DNSSEC security protocol. DNSSEC is intended to prevent DNS exploits such as cache poisoning. All 13 root servers are now serving a signed version of the root...
OneHTTPD <= 0.6 Directory Traversal Vulnerability - Active Check
OneHTTPD is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Copyright C 2010 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Mini Web Server Cross Site Scripting and Directory Traversal Vulnerabilities
Mini Web Server is prone to a directory traversal vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright ...
Splunk Inadvertently Exposes User Passwords
The passwords of customers on Splunk.com were revealed after some debug information leaked on to its production servers. The debug code exposed users passwords to Splunk.com as clear text, the company said. Read the full article. The Register...
Code injection
Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name CN field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate...
CVE-2010-1155
Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name CN field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate...
Microsoft Windows ISATAP Component IPv6 Address Spoofing Vulnerability
Description Microsoft Windows is prone to a spoofing vulnerability that affects the ISATAP component. An attacker can exploit this issue to spoof IPv6 addresses. This may allow the attacker to bypass filtering devices that rely on the source IPv6 addresses; information disclosure and other attack...
libESMTP <= 1.0.4 Multiple Vulnerabilities
libESMTP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:stafford.uklinux:libesmtp";...
libESMTP multiple vulnerabilities
This host has libESMTP installed and is prone to multiple vulnerabilities. Vulnerabilities Insight: Multiple flaws are due to: - An error in 'matchcomponent' function in 'smtp-tls.c' when processing substrings. It treats two strings as equal if one is a substring of the other, which allows...
dns-fuzz NSE Script
Launches a DNS fuzzing attack against DNS servers. The script induces errors into randomly generated but valid DNS packets. The packet template that we use includes one uncompressed and one compressed name. Use the dns-fuzz.timelimit argument to control how long the fuzzing lasts. This script...
ms-sql-config NSE Script
Queries Microsoft SQL Server ms-sql instances for a list of databases, linked servers, and configuration settings. SQL Server credentials required: Yes use ms-sql-brute, ms-sql-empty-password and/or mssql.username & mssql.password Run criteria: Host script: Will run if the mssql.instance-all,...
Zabbix 1.8.1 - SQL Injection
Zabbix 1.8.1 - SQL Injection ============================================= - Release date: April 1st, 2010 - Discovered by: Dawid Golunski - Severity: High ============================================= I. VULNERABILITY ------------------------- Zabbix = 1.8.1 SQL Injection II. BACKGROUND...
Design/Logic Flaw
libESMTP, probably 1.0.4 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...
CVE-2010-1192
libESMTP, probably 1.0.4 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...
CVE-2010-1192
libESMTP, probably 1.0.4 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...
Microsoft Security Bulletin MS10-018 - Critical Cumulative Security Update for Internet Explorer (980182)
Microsoft Security Bulletin MS10-018 - Critical Cumulative Security Update for Internet Explorer 980182 Published: March 30, 2010 Version: 1.0 General Information Executive Summary This security update resolves nine privately reported vulnerabilities and one publicly disclosed vulnerability in...
uHTTP Server GET Request Directory Traversal Vulnerability
uHTTP Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue will allow an attacker to view arbitrary local files and directories within the context of the webserver. Information harvested may aid in launching...