VMSA-2012-0016 : VMware security updates for vSphere API and ESX Service Console

a. VMware vSphere API denial of service vulnerability The VMware vSphere API contains a denial of service vulnerability. This issue allows an unauthenticated user to send a maliciously crafted API request and disable the host daemon. Exploitation of the issue would prevent management activities o...

CVE-2012-1896

Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote attackers to obtain sensitive information via 1 a crafted XAML browser application aka XBAP or 2 a crafted .NET Framework application, aka "Code Access Securi...

Information disclosure

Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote attackers to obtain sensitive information via 1 a crafted XAML browser application aka XBAP or 2 a crafted .NET Framework application, aka "Code Access Securi...

CVE-2012-1896

Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote attackers to obtain sensitive information via 1 a crafted XAML browser application aka XBAP or 2 a crafted .NET Framework application, aka "Code Access Securi...

CVE-2012-1896

CVE-2012-1896 affects Microsoft .NET Framework 2.0 SP2 and 3.5.1, where trust levels are not properly respected during output data construction, enabling information leakage via crafted XBAPs or partially trusted code in .NET applications. The vulnerability is described as an information-disclosu...

PT-2012-3634 · Microsoft · .Net Framework

Name of the Vulnerable Software and Affected Versions: Microsoft .NET Framework versions 2.0 SP2 through 3.5.1 Description: The issue is related to the improper consideration of trust levels during the construction of output data, allowing remote attackers to obtain sensitive information. This ca...

Veeam Explorer for Microsoft Exchange: Could not establish trust relationship for the SSL/TLS secure channel

Challenge When restoring items with Veeam Explorer for Microsoft Exchange or sending them as attachments, the following error occurs: The request failed. The underlying connection was closed: could not establish trust relationship for the SSL/TLS secure channel Cause There are two possible causes...

PT-2012-6122 · Jpmorgan Chase · Chase Mobile Banking Application

Name of the Vulnerable Software and Affected Versions: Chase mobile banking application for Android affected versions not specified Description: The issue concerns a failure to verify the server hostname against the domain name in the X.509 certificate's Common Name CN or subjectAltName field. Th...

DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust

US-CERT reports: DomainKeys Identified Mail DKIM Verifiers may inappropriately convey message trust when messages are signed using test or small bit signing keys...

DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust

Overview DomainKeys Identified Mail DKIM Verifiers may inappropriately convey message trust when messages are signed using keys that are too weak 1024 bits or that are marked as test keys. Description RFC 6376 states "DomainKeys Identified Mail DKIM permits a person, role, or organization to clai...

Analysis Shows Some URL Shorteners Often Point to Untrusted Websites

In an analysis of 1.7 billion shortened URLs, researchers at Web of Trust found that 8.7 percent of TinyURLs and five percent of Bit.ly URLs lead to sites that received poor ratings for ‘trustworthiness’ and ‘child protection.’ “Certainly the URL shortening services don’t intend to point people t...

SSL Digital Certificate Security Issues Put CAs on Notice

It’s been a rough couple of years for the security of fundamental Internet infrastructure technologies such the domain name system DNS, SSL and digital certificates. Hackers are taking aim at these core technologies at the heart of ecommerce and online communication, and are more often than not,...

Mandrake Linux Security Advisory : gnupg (MDKSA-2000:087)

When importing keys from public key servers, GnuPG will import private keys also known as secret keys in addition to public keys. If this happens, the user's web of trust becomes corrupt. Additionally, when used to check detached signatures, if the data file being checked contains clearsigned dat...

Researcher Finds iPhone Bug Allows SMS Spoofing

The iPhone SMS app contains a quirky bug that could allow someone to send a user a text message that appears to come from any number that the sender specifies. The researcher who discovered the bug said that it could be used by attackers to spoof messages from a bank or credit card company and se...

Cisco IP Communicator Certificate Trust List Man-in-the-Middle Attack Vulnerability

Cisco IP Communicator contains a vulnerability that could allow an unauthenticated, remote attacker to conduct man-in-the-middle attacks on a targeted system. The vulnerability is due insufficient validation of signing certificates in the Certificate Trust List which have been accepted by end...

CVE-2012-2490

Cisco IP Communicator 8.6 allows man-in-the-middle attackers to modify the Certificate Trust List via unspecified vectors, aka Bug ID CSCtz01471...

Code injection

Cisco IP Communicator 8.6 allows man-in-the-middle attackers to modify the Certificate Trust List via unspecified vectors, aka Bug ID CSCtz01471...

CVE-2012-2490

CVE-2012-2490 affects Cisco IP Communicator 8.6. An unauthenticated, remote attacker could carry out a Man-in-the-Middle attack to replace or modify the Certificate Trust List due to insufficient validation of signing certificates in the Trust List (Bug CSCtz01471). Exploitation details are not f...

CVE-2012-2490

Cisco IP Communicator 8.6 allows man-in-the-middle attackers to modify the Certificate Trust List via unspecified vectors, aka Bug ID CSCtz01471...

FreeBSD : dns/bind9* -- Heavy DNSSEC Validation Load Can Cause a 'Bad Cache' Assertion Failure (0bc67930-d5c3-11e1-bef6-0024e81297ae)

ISC reports : High numbers of queries with DNSSEC validation enabled can cause an assertion failure in named, caused by using a 'bad cache' data structure before it has been initialized. BIND 9 stores a cache of query names that are known to be failing due to misconfigured name servers or a broke...