Privoxy Denial of Service Vulnerability

Privoxy is a proxy server with filtering for HTTP and HTTPS protocols, often used in combination with Tor. A denial of service vulnerability exists in Privoxy that allows remote attackers to launch denial of service attacks via unspecified vectors...

Oracle Database Server Remote Vulnerability (CNVD-2015-00490)

Oracle Database is a large database of commercial nature. A remote vulnerability exists in Oracle Database Server that allows an attacker to gain 'Valid account' privileges using the 'HTTP' protocol...

Hillstone HS TFTP Server Denial of Service Vulnerability

Hillstone HS TFTP Server is the TFTP service program built into the hillstone series. A denial of service vulnerability exists in Hillstone HS TFTP Server version 1.3.2 that allows remote attackers to cause a denial of service via a long filename in an RRQ or WRQ operation...

UBUNTU-CVE-2014-3556

The STARTTLS implementation in mail/ngxmailsmtphandler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command...

DEBIAN-CVE-2014-1693

Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the 1 user, 2 account, 3 cd, 4 ls, 5 nlist, 6 rename, 7 delete, 8 mkdir, 9 rmdir, 10 recv, 11 recvbin, 12 recvchunkstart, 13 send...

UBUNTU-CVE-2014-1693

Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the 1 user, 2 account, 3 cd, 4 ls, 5 nlist, 6 rename, 7 delete, 8 mkdir, 9 rmdir, 10 recv, 11 recvbin, 12 recvchunkstart, 13 send...

wget: FTP symlink arbitrary filesystem access

A flaw was found in the way Wget handled symbolic links. A malicious FTP server could allow Wget running in the mirror mode using the '-m' command line option to write an arbitrary file to a location writable to by the user running Wget, possibly leading to code execution...

[SECURITY] Fedora 20 Update: tnftp-20141031-1.fc20

tnftp is the FTP File Transfer Protocol client from NetBSD. FTP is a wid ely used protocol for transferring files over the Internet and for archiving fi les. tnftp provides some advanced features beyond the Linux netkit ftp client, b ut maintains a similar user interface to the traditional ftp...

wget: FTP symlink arbitrary filesystem access

A flaw was found in the way Wget handled symbolic links. A malicious FTP server could allow Wget running in the mirror mode using the '-m' command line option to write an arbitrary file to a location writable to by the user running Wget, possibly leading to code execution...

Easy FTP Pro 4.2 iOS - Command Injection Vulnerabilities

No description provided by source. Document Title: =============== Easy FTP Pro v4.2 iOS - Command Inject Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1291 Release Date: ============= 2014-08-06 Vulnerability Laboratory ID VL-ID:...

Easy FTP Pro 4.2 iOS - Command Injection

Easy FTP Pro 4.2 iOS - Command Injection Document Title: =============== Easy FTP Pro v4.2 iOS - Command Inject Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1291 Release Date: ============= 2014-08-06 Vulnerability Laboratory ID VL-ID:...

Easy FTP Pro 4.2 iOS - Script Code Inject Vulnerabilities

Document Title: =============== Easy FTP Pro 4.2 iOS - Script Code Inject Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1291 Release Date: ============= 2014-08-06 Vulnerability Laboratory ID VL-ID: ====================================...

UBUNTU-CVE-2014-2892

Heap-based buffer overflow in the getanswer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP MMSH server response...

SSL/TLS CRIME attack against HTTPS

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differenc...

wireshark: DoS (infinite loop) in the HTTP dissector (wnpa-sec-2013-39)

The httppayloadsubdissector function in epan/dissectors/packet-http.c in the HTTP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 does not properly determine when to use a recursive approach, which allows remote attackers to cause a denial of service stack consumption via a...

PT-2014-3803 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software version 9.1.3 and earlier Description: A race condition in the Phone Proxy component allows remote attackers to bypass sec db authentication and provide certain pass-through services to untrusted...

DEBIAN-CVE-2010-5294

Multiple cross-site scripting XSS vulnerabilities in the requestfilesystemcredentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a 1 FTP or 2 SSH connection attempt...

PT-2013-6248 · Cisco · Cisco Unified Communications Manager

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Manager affected versions not specified Description: The TFTP service allows remote attackers to obtain sensitive information from a phone via an RRQ operation, as demonstrated by discovering a cleartext...

USN-1811-1: Linux kernel (OMAP4) vulnerabilities

Mathias Krause discovered an information leak in the Linux kernel's UDF file system implementation. A local user could exploit this flaw to examine some of the kernel's heap memory. CVE-2012-6548 Mathias Krause discovered an information leak in the Linux kernel's ISO 9660 CDROM file system driver...

apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...