HP-UX ftpd PAM Authentication Configuration Weakness Authentication Bypass

According to its banner, the version of the HP-UX FTP server running on the remote host is at a patch level before PHNE38458. Such versions reportedly contain a vulnerability that in certain account configurations could be exploited by an anonymous remote attacker to gain privileged access. Note...

PowerDNS Authoritative Server Malformed Query Cache Poisoning Weakness

The remote DNS drops malformed queries. If it is not just a resolver and serves a domain name, this may help poisoning the cache of other DNS resolvers. PoweDNS 2.9.21 and earlier are known to exhibit this behavior. Note that this does not mean that this server would be vulnerable to cache...

Spree Hardcoded config.action_controller_session Hash Value Cryptographic Protection Weakness

Spree contains a hardcoded flaw related to the config.actioncontrollersession hash value. This may allow an attacker to more easily bypass cryptographic protection...

GLSA-200808-03 : Mozilla products: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200808-03 Mozilla products: Multiple vulnerabilities The following vulnerabilities were reported in all mentioned Mozilla products: TippingPoint's Zero Day Initiative reported that an incorrect integer data type is used as a CSS...

.svn/entries Disclosed via Web Server

The web server on the remote host allows read access to '.svn/entries' files. This exposes all file names in your svn module on your website. This flaw can also be used to download the source code of the scripts PHP, JSP, etc... hosted on the remote server. %NASLMINLEVEL 70300 Changes by Tenable ...

Debian DSA-1619-1 : python-dns - DNS response spoofing

Multiple weaknesses have been identified in PyDNS, a DNS client implementation for the Python language. Dan Kaminsky identified a practical vector of DNS response spoofing and cache poisoning, exploiting the limited entropy in a DNS transaction ID and lack of UDP source port randomization in many...

Mozilla Thunderbird < 2.0.0.16 Multiple Vulnerabilities

Binary data 4609.prm...

Debian DSA-1616-2 : clamav - denial of service

Damian Put discovered a vulnerability in the ClamAV anti-virus toolkit's parsing of Petite-packed Win32 executables. The weakness leads to an invalid memory access, and could enable an attacker to crash clamav by supplying a maliciously crafted Petite-compressed binary for scanning. In some...

RunCMS 1.6.1 - 'bbPath[root_theme]' Remote File Inclusion

source: https://www.securityfocus.com/bid/30331/info RunCMS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks a...

PHP weak 64 bit random seed

The GENERATESEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against...

Icecast 远端阻断服务弱点

CVE ID: CVE-2001-1083 Icecast 1.01.3.7 版内含 DoS 安全漏洞, 如果伺服器打开了 http-server file streaming 支援, 入侵者即可利用来达成 DoS 攻击; Http-server file streaming 内定是关闭的, 但是在 "icecasr.conf" 打开 "staticdir" 功能时, 此功能即会启动。 这个 DoS 攻击造成 Windows 的 "Application Error", 因此将造成 Icecast-server 整个当掉. 此 DoS 攻击是在 mp3 档案结尾加上 "/" or ""...

SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5405)

Mozilla Firefox was updated to version 2.0.0.15, fixing various bugs including following security bugs : - Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory...

SuSE 10 Security Update : bind (ZYPP Patch Number 5409)

The transaction id and the udp source port used for DNS queries by the bind nameserver were predicatable. Attackers could potentially exploit that weakness to manipulate the DNS cache 'DNS cache poisoning', CVE-2008-1447. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description o...

BIND: Cache poisoning

Background ISC BIND is the Internet Systems Consortium implementation of the Domain Name System DNS protocol. Description Dan Kaminsky of IOActive has reported a weakness in the DNS protocol related to insufficient randomness of DNS transaction IDs and query source ports. Impact An attacker could...

Mozilla Foundation Security Advisory 2008-31

Mozilla Foundation Security Advisory 2008-31 Title: Peer-trusted certs can use alt names to spoof Impact: Moderate Announced: July 1, 2008 Reporter: John G. Myers Products: Firefox 2, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.15 SeaMonkey 1.1.10 Description Mozilla developer John G. Myers...

PHP weak 64 bit random seed

The GENERATESEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against...

Firefox < 2.0.0.15 Multiple Vulnerabilities

The installed version of Firefox is affected by various security issues : - Several stability bugs leading to crashes which, in some cases, show traces of memory corruption MFSA 2008-21. - A vulnerability involving violation of the same-origin policy could allow for cross-site scripting attacks...

Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : openssl-blacklist update (USN-612-11)

USN-612-3 addressed a weakness in OpenSSL certificate and key generation and introduced openssl-blacklist to aid in detecting vulnerable certificates and keys. This update adds RSA-4096 blacklists to the openssl-blacklist-extra package and adjusts openssl-vulnkey to properly handle RSA-4096 and...

Play a game of webshell game-bug warning-the black bar safety net

To hack the x-Files cast a draft, two months, and haven't selected, and now it sends to the Just look at it, the article is bad, Don't laugh,the picture is zoom out, tap the picture you can see the big picture. Play a game of webshell game The desert（baiker2008 Now many of the side dishes, speaki...

USN-612-11: openssl-blacklist update

USN-612-3 addressed a weakness in OpenSSL certificate and key generation and introduced openssl-blacklist to aid in detecting vulnerable certificates and keys. This update adds RSA-4096 blocklists to the openssl-blacklist-extra package and adjusts openssl-vulnkey to properly handle RSA-4096 and...