4770 matches found
[SE-2012-01] Yet another Reflection API flaw affecting Oracle's Java SE
Hello All, Today, a vulnerability report with an accompanying Proof of Concept code was sent to Oracle notifying the company of a new security weakness affecting Java SE 7 software. The new flaw was verified to affect all versions of Java SE 7 including the recently released 1.7.021-b11. It can b...
CMSLogik 1.2.1 User Enumeration Weakness
!/usr/bin/python CMSLogik 1.2.1 user param User Enumeration Weakness Vendor: ThemeLogik Product web page: http://www.themelogik.com/cmslogik Affected version: 1.2.1 and 1.2.0 Summary: CMSLogik is built on a solid & lightweight framework called CodeIgniter, and design powered by Bootstrap. This...
CMSLogik 1.2.1 (user param) User Enumeration Weakness
Summary CMSLogik is built on a solid & lightweight framework called CodeIgniter, and design powered by Bootstrap. This combination allows for greater security, extensive flexibility, and ease of use. You can use CMSLogik for almost any niche that your project might fall into. Description The...
Google AD Sync Tool - Exposure of Sensitive Information
Google AD Sync Tool - Exposure of Sensitive Information Sense of Security - Security Advisory - SOS-13-001 Release Date. 03-Apr-2013 Last Update. - Vendor Notification Date. 03-Sep-2012 Product. Google Active Directory Sync GADS Tool Platform. Windows, Linux, Solaris Affected versions. All versio...
Microsoft Internet Explorer Mouse Movement Information Disclosure
A design weakness vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in reference counting while handling the fireEvent method. Remote attackers can exploit this vulnerability by enticing the target user to view a malicious HTML document...
Mozilla Firefox - Cookie Verification Denial of Service
Mozilla Firefox - Cookie Verification Denial of Service source: https://www.securityfocus.com/bid/62969/info Mozilla Firefox is prone to a denial-of-service vulnerability because it fails to verify the user supplied input. Successfully exploiting this issue will allow an attacker to inject specia...
Mozilla Firefox - Cookie Verification Denial of Service
source: https://www.securityfocus.com/bid/62969/info Mozilla Firefox is prone to a denial-of-service vulnerability because it fails to verify the user supplied input. Successfully exploiting this issue will allow an attacker to inject special characters into the browser's local cookie storage,...
HP LeftHand Virtual SAN Appliance hydra Credential Information Disclosure (CVE-2012-3282)
An information disclosure vulnerability exists in HP LeftHand Virtual SAN Appliance. Successful exploitation will disclose credentials that could allow the attacker to log in to the server with administrator privileges. The vulnerability is due to a design weakness and occurs when a snapshot...
Git Repository Served by Web Server
The web server on the remote host allows read access to a Git repository. This potential flaw can be used to download content from the Web server that might otherwise be private. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...
Backupbuddy - importbuddy.php Restore Operation Persistence Weakness
The backupbuddy WordPress plugin was affected by an importbuddy.php Restore Operation Persistence Weakness security vulnerability...
Cisco IOS and Cisco IOS XE Type 4 Passwords Issue
This is the Cisco response to research performed by Mr. Philipp Schmidt and Mr. Jens Steube from the Hashcat Project "http://hashcat.net/oclhashcat-plus/" on the weakness of Type 4 passwords on Cisco IOS and Cisco IOS XE devices. Mr. Schmidt and Mr. Steube reported this issue to the Cisco PSIRT o...
tomcat5 security update
CentOS Errata and Security Advisory CESA-2013:0640 Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS ba...
CVE-2013-2273
CVE-2013-2273 affects bitcoind/Bitcoin-Qt releases prior to specific 0.4.9rc1, 0.5.x prior to 0.5.8rc1, 0.6.x prior to 0.6.0.11rc1, 0.6.1–0.6.5 prior to 0.6.5rc1, and 0.7.x prior to 0.7.3rc1. The issue allows remote attackers to obtain potentially sensitive information about the transaction chang...
Apache Httpd < 2.4.33 : Weak Digest auth nonce generation in mod_auth_digest
When generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker withou...
Adobe InDesign Server SOAP Request Lack of Authentication
Access control weakness vulnerability exists in Adobe InDesign Server.The vulnerability is due to a failure to restrict access to the SOAP interface.Successful exploitation could result in execution of arbitrary script code in the context of the service...
Debian Security Advisory DSA 2626-1 (lighttpd - several issues)
Several vulnerabilities were discovered in the TLS/SSL protocol. This update addresses these protocol vulnerabilities in lighttpd. CVE-2009-3555 Marsh Ray, Steve Dispensa, and Martin Rex discovered that the TLS and SSLv3 protocols do not properly associate renegotiation handshakes with an existin...
SuSE 10 Security Update : tomcat5 (ZYPP Patch Number 8397)
This update of tomcat5 fixed the following security issues : - tomcat: cnonce tracking weakness. CVE-2012-5885 - tomcat: stale nonce weakness. CVE-2012-5887 - tomcat: authentication caching weakness. CVE-2012-5886 - tomcat: affected by slowloris DoS. CVE-2012-5568 - tomcat: Bypass of security...
Cross-Site Scripting (XSS) vulnerability in gpEasy
Advisory ID: HTB23137 Product: gpEasy Vendor: gpeasy Vulnerable Versions: 3.5.2 and probably prior Tested Version: 3.5.2 Vendor Notification: January 2, 2013 Vendor Patch: January 2, 2013 Public Disclosure: January 23, 2013 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference:...
Scientific Linux Security Update : ipa-client on SL5.x i386/x86_64 (20130123)
A weakness was found in the way IPA clients communicated with IPA servers when initially attempting to join IPA domains. As there was no secure way to provide the IPA server's Certificate Authority CA certificate to the client during a join, the IPA client enrollment process was susceptible to...
CentOS 5 : ipa-client (CESA-2013:0189)
An updated ipa-client package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...