Scientific Linux Security Update : xen on SL5.x i386/x86_64

CVE-2009-3525 Xen: PyGrub missing support for password configuration command The pyGrub boot loader did not honor the 'password' option in the grub.conf file for para-virtualized guests. Users with access to a guest's console could use this flaw to bypass intended access restrictions and boot the...

Wireshark Multiple Vulnerabilities-01 March 11 (Mac OS X)

The host is installed with Wireshark and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbwiresharkmultvuln01mar11macosx.nasl 5958 2017-04-17 09:02:19Z teissa $ Wireshark Multiple Vulnerabilities-01 March 11 Mac OS X Authors: Madhuri D Copyright: Copyright c 2012 Greenbone...

CVE-2012-1872: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences with EUC-JP encoding, aka "EUC-JP Character Encoding Vulnerability."...

CVE-2012-1878: Improper Control of Generation of Code

Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnBeforeDeactivate Event Remote Code Execution Vulnerability."...

CVE-2012-1873: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Internet Explorer 7 through 9 does not properly create and initialize string data, which allows remote attackers to obtain sensitive information from process memory via a crafted HTML document, aka "Null Byte Information Disclosure Vulnerability."...

CVE-2012-1880: Improper Control of Generation of Code

Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "insertRow Remote Code Execution Vulnerability."...

CVE-2012-1879: Improper Control of Generation of Code

Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access an undefined memory location, aka "insertAdjacentText Remote Code Execution Vulnerability."...

CVE-2012-1876: Improper Control of Generation of Code

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution...

CVE-2012-1877: Improper Control of Generation of Code

Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Title Element Change Remote Code Execution Vulnerability."...

kernel security and bug fix update

2.6.18-308.8.1.el5 - net sock: validate datalen before allocating skb in sockallocsendpskb Jason Wang 816290 816106 CVE-2012-2136 - net tg3: Fix VLAN tagging assignments John Feeney 817691 797011 - net ixgbe: do not stop stripping VLAN tags in promiscuous mode Andy Gospodarek 809791 804800 - s390...

Cisco ASA Cut Through Proxy Authentication Vulnerability

The remote Cisco ASA is missing a security patch and may be affected by an information disclosure vulnerability. Requesting a resource behind the firewall causes the device to prompt the user for their credentials on a page served over HTTPS. This page contains a session ID. C Tenable Network...

persistent xss through svg file attachment download

The fix for CONF-22132 was not sufficient because "svg" files are not "said" to be xml by the isXml method. This means that is possible for a malicious party to upload a svg file containing html/javascript which will be rendered in victim's web browser. This bug should have been raised a while ag...

PT-2012-2509 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliances ASA 5500 series devices versions 7.2 through 8.4 Description: The issue allows remote attackers to obtain sensitive information via a connection attempt due to improper proxy authentication during attempts t...

CVE-2012-0269: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in JustSystems Ichitaro 2011 Sou, Ichitaro 2006 through 2011, Ichitaro Government 2006 through 2010, Ichitaro Portable with oreplug, Ichitaro Viewer, JUST School, JUST School 2009 and 2010, JUST Jump 4, JUST Frontier, oreplug, Shuriken Pro4, Shuriken 2007 through 2010, Shuriken Pr...

Wireshark X.509if Dissector Denial of Service Vulnerability (Mac OS X)

This host is installed with Wireshark and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: secpodwiresharkdissectordosvulnmacosx.nasl 6018 2017-04-24 09:02:24Z teissa $ Wireshark X.509if Dissector Denial of Service Vulnerability Mac OS X Authors: Madhuri D Copyright:...

CVE-2012-2420: Exposure of Sensitive Information to an Unauthorized Actor

The intu-help-qb aka Intuit Help System Async Pluggable Protocol handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to obtain sensitive information via a URI with a % percent character as its 1 last or 2...

CVE-2012-2421: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in the intu-help-qb aka Intuit Help System Async Pluggable Protocol handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to read arbitrary files in ZIP archives via a...

CVE-2012-2422: Exposure of Sensitive Information to an Unauthorized Actor

Intuit QuickBooks 2009 through 2012 might allow remote attackers to obtain pathname information via the qbwc://docontrol/GetCompanyFile functionality...

CVE-2012-0168: Improper Control of Generation of Code

Microsoft Internet Explorer 6 through 9 allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document that is not properly handled during a "Print table of links" print operation, aka "Print Feature Remote Code Execution Vulnerability."...

IBM DB2 Tivoli Monitoring Agent Privilege Escalation Vulnerability (Linux)

This host is installed with IBM DB2 and is prone to privilege escalation vulnerability. OpenVAS Vulnerability Test $Id: gbibmdb2itmaprivescalationvulnlin.nasl 6022 2017-04-25 12:51:04Z teissa $ IBM DB2 Tivoli Monitoring Agent Privilege Escalation Vulnerability Linux Authors: Madhuri D Copyright:...