Important: Red Hat Security Advisory: openstack-keystone security and bug fix update

Updated openstack-keystone packages that fix two security issues and multiple bugs are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which...

Vulnerability in OpenSSL - no-ssl3 configuration sets method to NULL

When openssl is built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl method would be set to NULL which could later result in a NULL pointer dereference...

SSL v3 "POODLE" Vulnerability

...

Cross site request forgery (csrf)

The V3 API in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issuedat value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification 1 GET or 2 HEAD request to v3/auth/tokens/...

PYSEC-2014-108

The V3 API in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issuedat value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification 1 GET or 2 HEAD request to v3/auth/tokens/...

CVE-2014-5252

The V3 API in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issuedat value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification 1 GET or 2 HEAD request to v3/auth/tokens/...

CVE-2014-5252

CVE-2014-5252 affects OpenStack Keystone. The V3 API in 2014.1.x (before 2014.1.2.1) and Juno (before Juno-3) mishandles issued_at for UUID v2 tokens, allowing remote authenticated users to bypass expiration by reusing tokens via GET or HEAD to /v3/auth/tokens/. Mitigation: upgrade Keystone to th...

UBUNTU-CVE-2014-5252

The V3 API in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issuedat value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification 1 GET or 2 HEAD request to v3/auth/tokens/...

V3 Chat - Profiles/Dating Script 3.0.2 - Insecure Cookie Handling Vuln

No description provided by source. + V3 Chat - Profiles/Dating Script v3.0.2 Insecure Cookie Handling Vulnerability + Discovered By : Mountassif Moad + Greetz : All my freind Exploit: javascript:document.cookie = admin=1; path=/; milw0rm.com 2008-11-08...

Mazens PHP Chat V3 (basepath) - Remote File Inclusion Vulnerabilities

No description provided by source. Mazen's PHP Chat V3.0.0 Beta1 Remote file inclusion Download script : http://www.scriptbrasil.com.br/script/php/batepapo/mazenphpopenchmt221.tar.gz Thanks Str0ke :D Exploit : http://victim.com/chatpath/include/pear/ITX.php?basepath=shell.txt?...

Zyxel P-660HW-T1 v3 Wireless Router - CSRF Vulnerability

No description provided by source. Exploit Title: Zyxel P-660HW-T1 v3 Wireless Router - CSRF Vulnerabilities Date: 05/22/2014 Author: Mustafa ALTINKAYNAK Vendor Homepage:http://www.zyxel.com/tr/tr/productsservices/p660hwseries.shtml?t=p Category: Hardware/Wireless Router Tested on: Zyxel P-660HW-...

AhnLab V3 Internet Security 8.0 <= 1.2.0.4 - Privilege Escalation Vulnerability

No description provided by source. AhnLab V3 Internet Security 8.0 with AhnRec2k.sys = 1.2.0.4 Local Kernel Mode Privilege Escalation Vulnerability AUTHOR MJ0011 EMAIL thdecoder $ 126.com VULNERABLE PRODUCTS AhnLab V3 Internet Security = 8.0.3.28?build 746 DETAILS: AhnRec2k.sys create a device...

MS Windows XP/2003 - (IGMP v3) Denial of Service Exploit (MS06-007) (2)

No description provided by source. / MS06-007 Denial of Service POC exploit created by Firestorm, based on zloSend.exe win32 exploit http://www.securitylab.ru/poc/264136.php Tested on Windows XP SP2 as victim compiled/runned on Fedore Core 4 x86 FOR EDUCATIONAL PURPOSE ONLY !!! / include stdio.h...

webl?sninger <= 4 - (xss/sql) Multiple Vulnerabilities

No description provided by source. Viva IsLaM sql / xss Multiple Vulnerabilities weblosning V1, V2,V3,V4 index2.php id Script Name : Weblosning V1, V2,V3,V4 Demo : http://www.simpelside.dk/ AuTh0r: Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM Email : [email protected] V1 ::V2 :: V3 :: V4 D0rk : allinurl:...

V3 Chat Instant Messenger - online.php site_id Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/18543/info V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker...

Charon Cart 3.0 - (Review.asp) Remote SQL Injection Vulnerability

No description provided by source. Vulnerability Report Title : Charon Cart v3Review.asp Remote SQL Injection Vulnerability Author : ajann Script Page : http://www.charon.co.uk Exploit; http://target/path/Review.asp?ProductID=SQL HERE Example:...

V3 Chat Live Support 3.0.4 - Insecure Cookie Handling Vulnerability

No description provided by source. ! ! ! OOOO O OOOOOOOOO ! ! O O O O O ! ! O O O ! ! O OOOO OOOO OOOOOO OOOO OOO OO O OOOO OO OO OOOO ! ! O OOO OOO O O O O OO O O O O OO O O O ! ! O OO OO O O OOOOOO O O O O O O OOOOOO ! ! O O OOOO O O O O O O O O O O O...

V3 Chat Instant Messenger - search.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/18543/info V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker...

V3 Chat Profiles/Dating Script 3.0.2 - (Auth Bypass) SQL Injection Vuln

No description provided by source. V3 Chat - Profiles/Dating Script v3.0.2 Auth Bypass Vulnerability ----------------------------------------------------------------- Discovered By: d3b4g contact: bl4ckendatgmaildotcom Risk: High -------------------------------------------------------------------...

JVN#36259412: Web Kyukincho vulnerable to cross-site request forgery

Web Kyukincho provided by Intercom, Inc. is a software that digitizes and distributes a pay statement and others. Web Kyukincho contains a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged in, unintended operations may be conducted. Solution Update the...