crypt(): DES encrypted password weakness

The cryptdes aka DES-based crypt function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an...

PHP 5.4.x < 5.4.4 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.4, and as such is potentially affected the following vulnerabilities : - An integer overflow error exists in the function 'pharparsetarfile' in the file 'ext/phar/tar.c'. This error can lead to a...

rack-cache Rubygem Sensitive HTTP Header Caching Weakness

Rack::Cache rack-cache contains a flaw related to the rubygem caching sensitive HTTP headers. This will result in a weakness that may make it easier for an attacker to gain access to a user's session via a specially crafted header...

Check Point response to "libcrypt 'crypt()' Password Encryption Weakness" (CVE-2012-2143)

...

Teen's Arrest Underscores Need for More Secure Web Development

A 15-year-old who claimed he was bored when he turned to hacking was arrested for breaking into almost 260 companies during the first three months of this year, according to a ZDNet article published earlier today. Austria’s Federal Criminal Police Office said the teenager, who used the hacker...

Multiple Vendor Products Security Vulnerabilities

Quantum Scalar i500, Dell ML6000, and IBM TS3310 are prone to following vulnerabilities: 1. An information-disclosure vulnerability 2. A cross-site scripting vulnerability 3. A cross-site request-forgery vulnerability 4. A security-bypass vulnerability An attacker may leverage these issues to...

IBM DB2 'nodes.reg' Permission Weakness Vulnerability

The host is running IBM DB2 and is prone to permission weakness vulnerability. OpenVAS Vulnerability Test $Id: gbibmdb2nodespermweakvuln.nasl 5963 2017-04-18 09:02:14Z teissa $ IBM DB2 'nodes.reg' Permission Weakness Vulnerability Authors: Madhuri D Copyright: Copyright c 2012 Greenbone Networks...

IBM Db2 'nodes.reg' Permission Weakness Vulnerability

IBM Db2 is prone to a permission weakness vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ibm:db2"; ifdescription...

openssl security and bug fix update

1.0.0-20.3 - fix problem with the SGC restart patch that might terminate handshake incorrectly - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS7 code 802725 - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers 802489...

tomcat: Multiple weaknesses in HTTP DIGEST authentication

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability th...

tomcat: Multiple weaknesses in HTTP DIGEST authentication

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weak...

MySQL < 6.0.9-alpha / 5.5.3 Access Control Weakness

The version of MySQL installed on the remote host is older than 6.0.9-alpha / 5.5.3. As such, it reportedly allows a remote attacker to bypass access restrictions when the data directory contains a symbolic link to a different file system. C Tenable Network Security, Inc. include"compat.inc"; if...

CVE-2011-5044

SopCast 3.4.7.45585 uses weak permissions Everyone:Full Control for Diagnose.exe, which allows local users to execute arbitrary code by replacing Diagnose.exe with a Trojan horse program...

Mozilla Firefox Cache Objects History Enumeration Weakness Vulnerability (MAC OS X)

The host is installed with Mozilla Firefox and is prone to cache objects history enumeration weakness vulnerability. OpenVAS Vulnerability Test $Id: gbmozillafirefoxcacheobjenumweaknessvulnmacosx.nasl 7006 2017-08-25 11:51:20Z teissa $ Mozilla Firefox Cache Objects History Enumeration Weakness...

Researchers Identify Serious Capability Leaks in Many Android Phones

Many of the apps that come pre-installed on a variety of Android devices from manufacturers such as HTC, Samsung, Google and others have access to more services and capabilities on the devices than they should or that users are aware they have, according to new research. These “capability leaks”...

iTunes < 10.5.1 Update Authenticity Verification Weakness (Mac OS X)

The version of iTunes installed on the remote Mac OS X host is earlier than 10.5.1. As such, it uses an unsecured HTTP connection when checking for or retrieving software updates, which could allow a man-in-the-middle attacker to provide a Trojan horse update that appears to originate from Apple....

PHP ip2long Function String Validation Weakness

According to its banner, the 'ip2long' function in the version of PHP installed on the remote host may incorrectly validate an arbitrary string and return a valid network IP address. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Apple iTunes < 10.5.1 Update Authenticity Verification Weakness (uncredentialed check)

The version of Apple iTunes on the remote host is prior to version 10.5.1. It is, therefore, affected by a man-in-the-middle vulnerability due to using unsecured HTTP connections when checking for or retrieving software updates. A remote attacker can exploit this to execute arbitrary code by mean...

iTunes < 10.5.1 Update Authenticity Verification Weakness

Binary data 6098.prm...

Linux Kernel 3.0.4 - procinterrupts Password Length Local Information Disclosure

Linux Kernel 3.0.4 - procinterrupts Password Length Local Information Disclosure / source: https://www.securityfocus.com/bid/50573/info The Linux kernel is prone to a local information-disclosure weakness. Successful exploits allow local attackers to obtain the password length of a victim's...