Firefox < 31.0 Multiple Vulnerabilities

The version of Firefox installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities : - When a pair of NSSCertificate structures are added to a trust domain and then one of them is removed during use, a use-after-free error occurs which may...

Design/Logic Flaw

Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during 1 page, 2 panel, or 3 toolbar customization...

Microsoft Releases Security Advisory for Improperly Issued Digital Certificates

Microsoft has released a security advisory to address improperly issued SSL certificates that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. This issue affects all supported releases of Microsoft Windows. Users and administrators are...

EQdkp <= 1.3.1 (Referer Spoof) Remote Database Backup Vulnerability

No description provided by source. Title: EQdkp = 1.3.1 Referer Spoof to access to SQL Database URL: http://www.eqdkp.com Hook: Powered by EQdkp Author: Eight10 Contact: [email protected] --------------------------------------------------------------------------------------------------------...

Linux kernel 2.0.30/2.0.35/2.0.36/2.0.37 - Blind TCP Spoofing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/580/info Certain Linux kernels in the 2.0.3x range are susceptible to blind TCP spoofing attacks due to the way that the kernel handles invalid ack sequence numbers, and the way it assigns IDs to outgoing IP datagrams. Fo...

UFO: Alien Invasion 2.2.1 - BoF Exploit (Win7 ASLR and DEP Bypass)

No description provided by source. !/usr/bin/python Exploit Title: UFO: Alien Invasion v2.2.1 BoF Exploit Win7 ASLR and DEP Bypass Date: July 5, 2010 Author: Node Software Link: http://sourceforge.net/projects/ufoai/files/UFOAI%202.x/2.2.1/ufoai-2.2.1-win32.exe/download Version: UFO: Alien Invasi...

openSUSE Security Update : libcgroup-devel (openSUSE-SU-2011:0316-1)

libcgroup suffered from a heap based buffer overflow CVE-2011-1006. The cgrulesengd daemon did not verify the origin of netlink messages, allowing local users to spoof events CVE-2011-1022. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Design/Logic Flaw

WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, does not properly interpret Unicode encoding, which allows remote attackers to spoof a postMessage origin, and bypass intended restrictions on sending a message to a connected frame or window, via crafted characters in a URL...

Localize: missing sender policy framework (SPF)

A Valid TXT Record was not found in localize.im This can spoof your email address. Proof of Concept: http://mxtoolbox.com/SuperTool.aspx?action=spf:localize.im&run=toolpage related article: Missing SPF for hackerone.com...

KLA10007 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome 34.0.1847.137 and earlier. Malicious can use these vulnerabilities to cause denial of service, spoof UI or possibly other impact. Below is a complete list of vulnerabilities 1. use-after-free in StyleElement::removedFromDocument...

GLSA-201405-22 : Pidgin: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201405-22 Pidgin: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Pidgin. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code...

Code injection

Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names, which allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam...

Design/Logic Flaw

PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate...

PYSEC-2014-93

PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate...

CVE-2013-2073

Transifex command-line client before 0.9 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate...

CVE-2013-2073

Transifex command-line client before 0.9 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate...

CVE-2014-0350

The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate...

CVE-2014-2734

The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operation...

Design/Logic Flaw

The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operation...

CVE-2014-2900

wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions, which allows man-in-the-middle attackers to spoof servers via crafted X.509 certificate...