Mandriva Update for rpmdrake MDVA-2008:131 (rpmdrake)

Check for the Version of rpmdrake OpenVAS Vulnerability Test Mandriva Update for rpmdrake MDVA-2008:131 rpmdrake Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Ubuntu Update for firefox vulnerabilities USN-490-1

Ubuntu Update for Linux kernel vulnerabilities USN-490-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN4901.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for firefox vulnerabilities USN-490-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

kernel: enforce a minimum SG_IO timeout

libata in the Linux kernel before 2.6.27.9 does not set minimum timeouts for SGIO requests, which allows local users to cause a denial of service Programmed I/O mode on drives via multiple simultaneous invocations of an unspecified test program...

Flash movie can determine whether a TCP port is open

ActionScript 3 AS3 in Adobe Flash Player 9.0.47.0, and other versions and other 9.0.124.0 and earlier versions, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash SWF movie that specifies a connection to make, then...

CVE-2003-1562

MODE C CVE-2003-1562 refers to a race condition in sshd/OpenSSH 3.6.1p2 and earlier, where with PermitRootLogin disabled and using PAM keyboard-interactive authentication, sshd does not insert a delay after a root password attempt. This timing discrepancy could enable remote attackers to infer wh...

CVE-2003-1562

sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the installer in Serendipity S9Y 1.3 allow remote attackers to inject arbitrary web script or HTML via 1 unspecified path fields or 2 the database host field. NOTE: the timing window for exploitation of this issue might be limited...

Design/Logic Flaw

Mozilla Firefox before 2.0.0.12 and Thunderbird before 2.0.0.12 does not properly manage a delay timer used in confirmation dialogs, which might allow remote attackers to trick users into confirming an unsafe action, such as remote file execution, by using a timer to change the window focus, aka...

Debian: Security Advisory (DSA-1338-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 253-1 (openssl)

The remote host is missing an update to openssl announced via advisory DSA 253-1. OpenVAS Vulnerability Test $Id: deb2531.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 253-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 253-1 (openssl)

The remote host is missing an update to openssl announced via advisory DSA 253-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 10 Security Update : epiphany (epiphany-4870)

This update brings the Mozilla XUL runner engine to security update version 1.8.1.10 MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inne...

Flash movie can determine whether a TCP port is open

ActionScript 3 AS3 in Adobe Flash Player 9.0.47.0, and other versions and other 9.0.124.0 and earlier versions, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash SWF movie that specifies a connection to make, then...

Mozilla Foundation Security Advisory 2007-39

Mozilla Foundation Security Advisory 2007-39 Title: Referer-spoofing via window.location race condition Impact: High Announced: November 26, 2007 Reporter: Gregory Fleischer Products: Firefox, SeaMonkey Fixed in: Firefox 2.0.0.10 SeaMonkey 1.1.7 Description Gregory Fleischer demonstrated that it...

Firefox < 2.0.0.10 Multiple Vulnerabilities

The installed version of Firefox is affected by various security issues : - Three bugs that can result in crashes with traces of memory corruption - A cross-site scripting vulnerability involving support for the 'jar:' URI scheme - A timing issue when setting the 'window.location' property that...

Referer-spoofing via window.location race condition — Mozilla

Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery CSRF attack against websites that rely only on the Referer header as...

[waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11

waraxe-2007-SA053 - Critical Sql Injection in NukeSentinel 2.5.11 ==================================================================== Author: Janek Vind "waraxe" Date: 25. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-53.html Target software description:...

CVE-2007-4324

ActionScript 3 AS3 in Adobe Flash Player 9.0.47.0, and other versions and other 9.0.124.0 and earlier versions, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash SWF movie that specifies a connection to make, then...

CVE-2007-4324

Summary: CVE-2007-4324 affects Adobe Flash Player (and related Flash plugins) where ActionScript/Flash content could be used to determine open ports on a target via timing discrepancies in SecurityErrorEvent handling. Connected advisories (RHSA/RHSA sub-pages) confirm this issue as part of multip...

Debian DSA-1339-1 : iceape - several vulnerabilities

Several remote vulnerabilities have been discovered in the Iceape internet suite, an unbranded version of the SeaMonkey Internet Suite. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3089 Ronen Zilberman and Michal Zalewski discovered that a timing...