SEC Consult SA-20111230-0 :: Critical authentication bypass in Microsoft ASP.NET Forms - CVE-2011-3416

SEC Consult Vulnerability Lab Security Advisory 20111230-0 ======================================================================= title: Microsoft ASP.NET Forms Authentication Bypass product: Microsoft .NET Framework vulnerable version: Microsoft .NET Framework Version:4.0.30319; ASP.NET...

squid proxy server buffer overflow

Crash on DNS response parsing...

ICU library memory corruption

Memory corruption on locale processing...

FreeBSD Security Advisory FreeBSD-SA-11:08.telnetd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-11:08.telnetd Security Advisory The FreeBSD Project Topic: telnetd code execution vulnerability Category: core Module: contrib Announced: 2011-12-23 Affects: All...

[ MDVSA-2011:194 ] icu

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2011:194 http://www.mandriva.com/security/ Package : icu Date : December 27, 2011 Affected: 2010.1, 2011., Enterprise Server 5.0 Problem Description: A vulnerability has been discovered and corrected in icu: A...

n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table

n.runs AG http://www.nruns.com/ securityatnruns.com n.runs-SA-2011.004 28-Dec-2011 Vendors: PHP, http://www.php.net Oracle, http://www.oracle.com Microsoft, http://www.microsoft.com Python, http://www.python.org Ruby, http://www.ruby.org Google, http://www.google.com Affected Products: PHP 4 and ...

[oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision

2011-003 multiple implementations denial-of-service via hash algorithm collision Description: A variety of programming languages suffer from a denial-of-service DoS condition against storage functions of key/value pairs in hash data structures, the condition can be leveraged by exploiting...

Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Memory corruptions, protection bypass, integer overflows, DoS conditions...

FreeBSD Security Advisory FreeBSD-SA-11:07.chroot

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-11:07.chroot Security Advisory The FreeBSD Project Topic: Code execution via chrooted ftpd Category: core Module: libc Announced: 2011-12-23 Affects: All supporte...

FreeBSD Security Advisory FreeBSD-SA-11:10.pam

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-11:10.pam Security Advisory The FreeBSD Project Topic: pamstart does not validate service names Category: contrib Module: pam Announced: 2011-12-23 Credits:...

FreeBSD Security Advisory FreeBSD-SA-11:09.pam_ssh

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-11:09.pamssh Security Advisory The FreeBSD Project Topic: pamssh improperly grants access when user account has unencrypted SSH private keys Category: contrib...

[ MDVSA-2011:193 ] squid

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2011:193 http://www.mandriva.com/security/ Package : squid Date : December 27, 2011 Affected: 2011. Problem Description: A vulnerability has been discovered and corrected in squid: The idnsGrokReply function in...

MITKRB5-SA-2011-008 buffer overflow in telnetd [CVE-2011-4862]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2011-008 MIT krb5 Security Advisory 2011-008 Original release: 2011-12-26 Last update: 2011-12-26 Topic: buffer overflow in telnetd CVE-2011-4862 CVSSv2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C CVSSv2 Base Score: 10 Access Vector:...

Lighttpd Proof of Concept code for CVE-2011-4362

29 of November 2011 was the date of public disclosure interesting vulnerability in lighttpd server. Xi Wang discovered that modauth for this server does not propely decode characters from the extended ASCII table. The vulnerable code is below: "src/httpauth.c:67" --- CUT --- static const short...

FreeBSD multiple security vulnerabilities

Invalid nsdispatch implementation for chroot'ed environment, multiple PAM vulnerabilities...

lighthttpd security vulnerabilities

DoS on base64 parsing...

Multiple vulnerabilities in epesi BIM

Vulnerability ID: HTB23061 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinepesibim.html Product: epesi BIM Vendor: Telaxus LLC http://www.epesibim.com/ Vulnerable Version: 1.2.0-rev8154 and probably prior Tested Version: 1.2.0-rev8154 Vendor Notification: 30 November 2011...

ZDI-11-354 : HP Managed Printing Administration jobDelivery Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-354 : HP Managed Printing Administration jobDelivery Multiple Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-11-354 December 22, 2011 - -- CVE ID: CVE-2011-4168 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors:...

ZDI-11-353 : HP Managed Printing Administration MPAUploader.dll Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-353 : HP Managed Printing Administration MPAUploader.dll Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-353 December 22, 2011 - -- CVE ID: CVE-2011-4167 - -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C - --...

WhatsApp messenging protocol multiple security vulnerabilities

Unauthroized user status change, registration bypass, cleartext data transmission...

Multiple vulnerabilities in PHPShop CMS Free

Vulnerability ID: HTB23058 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinphpshopcmsfree.html Product: PHPShop CMS Free Vendor: PHPShop Software http://www.phpshopcms.ru/ Vulnerable Version: 3.4 and probably prior Tested Version: 3.4 Vendor Notification: 23 November 2011...

Microsoft Windows multiple security vulnerabilities

Buffer overflow on TTF fonts parsing, OLE objects memory corruption, CSRSS and kernel privilege escalations, ActiveX code execution...

[SECURITY] [DSA 2366-1] mediawiki security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2366-1 [email protected] http://www.debian.org/security/ Jonathan Wiltshire December 18, 2011 http://www.debian.org/security/faq -...

ZDI-11-350 : Enterasys NetSight nssyslogd PRI Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-350 : Enterasys NetSight nssyslogd PRI Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-350 December 19, 2011 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors: Enterasys - --...

Enterasys NetSight buffer overflow

nssyslogd buffer overflow on UDP/514 packet parsing...

Tiki Wiki CMS Groupware <= 8.2 (snarf_ajax.php) Remote PHP Code Injection

------------------------------------------------------------------------- Tiki Wiki CMS Groupware = 8.2 snarfajax.php Remote PHP Code Injection ------------------------------------------------------------------------- author...........: Egidio Romano aka EgiX mail.............:...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

TWSL2011-019: Cross-Site Scripting Vulnerability in phpMyAdmin

Trustwave's SpiderLabs Security Advisory TWSL2011-019: Cross-Site Scripting Vulnerability in phpMyAdmin https://www.trustwave.com/spiderlabs/advisories/TWSL2011-019.txt Published: 12/22/11 Version: 1.0 Vendor: phpMyAdmin http://www.phpmyadmin.net/ Product: phpMyAdmin Version affected: 3.4.8 and...

[MATTA-2011-001] pfSense x509 Insecure Certificate Creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Matta Consulting - Matta Advisory https://www.trustmatta.com pfSense x509 Insecure Certificate Creation Advisory ID: MATTA-2011-001 CVE reference: CVE-2011-4197 Affected platforms: pfSense Version: 2.0 Date: 2011-October-09 Security risk: High...

VUPEN Security Research - Microsoft Windows Time Behaviour Remote Use-after-free Vulnerability (MS11-090)

VUPEN Security Research - Microsoft Windows Time Behaviour Remote Use-after-free Vulnerability MS11-090 Website : http://www.vupen.com/english/research.php Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- Microsoft Windows is a series of software operating systems and...

Tiki Wiki CMS Groupware Stored Cross-Site-Scripting

Advisory: Tiki Wiki CMS Groupware Stored Cross-Site-Scripting Advisory ID: INFOSERVE-ADV2011-07 Author: Stefan Schurtz Contact: [email protected] Affected Software: Successfully tested on Tiki 8.1 & 6.4 LTS affects all current releases Vendor URL: http://info.tiki.org/ Vendor Status: fixed...

pfSense invalid certificates issue

All certificates are issued with CA:true flag...

tor buffer overflows

Heap buffer overflow on SOCKS request parsing...

Adobe Flash Player multiple security vulnerabilities

Multiple memory corruptions, buffer overflows, crossite data access...

Certificate Spoofing in Google Chrome for Android

Hello 3APA3A! I want to warn you about Certificate Spoofing in Google Chrome for Android. This vulnerability is low risk, but can be used by phishers for stealing certificates from legitimate sites for conducting phishing attacks. ------------------------- Affected products:...

SASHA v0.2.0 Mutiple XSS

Exploit Title: SASHA v0.2.0 Mutiple XSS Date: 12/16/11 Author: G13 Software Link: http://sourceforge.net/projects/sasha/files/ Version: 0.2.0 Category: webapps php Vulnerability When adding a new course to the schedule, the application relies on Client Side controls for input. This can easily be...

ZDI-11-352 : HP Managed Printing Administration jobAcct Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-352 : HP Managed Printing Administration jobAcct Multiple Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-11-352 December 22, 2011 - -- CVE ID: CVE-2011-4166 - -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C - -- Affected Vendors:...

Exploit for Asterisk Security Advisory AST-2011-013

A Metasploit module is attached that demonstrates how to enumerate Asterisk sip peers that have a nat setting different to the global sip nat setting as described in Asterisk Security Advisory AST-2011-013. The example below finds all peers with nat=yes, but the metasploit module will also work...

[ MDVSA-2011:191 ] libarchive

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2011:191 http://www.mandriva.com/security/ Package : libarchive Date : December 18, 2011 Affected: Enterprise Server 5.0 Problem Description: A heap-based buffer overflow flaw was discovered in libarchive. If a...

IBM TS3100 / IBM TS3200 tape libraries authentication bypass

Authentication bypass in Web interface...

[SECURITY] [DSA 2370-1] unbound security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2370-1 [email protected] http://www.debian.org/security/ Florian Weimer December 22, 2011 http://www.debian.org/security/faq -...

Microsoft Internet Explorer multiple security vulnerabilities

Information leakage, insecure library loading...

CSRF, DT and AB vulnerabilities in D-Link DSL-500T ADSL Router

Hello 3APA3A! I want to warn you about new security vulnerabilities in D-Link DSL-500T ADSL Router. Which I've found and disclosed last week. These are Cross-Site Request Forgery, Directory Traversal and Authentication Bypass vulnerabilities. This is my fifth advisory 3 and 4 were announced and...

[SECURITY] [DSA 2368-1] lighttpd security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------------- Debian Security Advisory DSA-2368-1 [email protected] http://www.debian.org/security/ Nico Golde Dec 20th, 2011 http://www.debian.org/security/faq -...

VUPEN Security Research - Adobe Flash Player "SAlign" Memory Corruption Vulnerability (CVE-2011-2459)

VUPEN Security Research - Adobe Flash Player "SAlign" Memory Corruption Vulnerability CVE-2011-2459 Website : http://www.vupen.com/english/research.php Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- Adobe Flash Player is a cross-platform browser-based application runtime...

Unbound DNS resolver DoS conditions

Different denial of service conditions...

TWSL2011-018: Authentication Bypass Vulnerability in IBM TS3100/TS3200 Web User Interface

Trustwave's SpiderLabs Security Advisory TWSL2011-018: Authentication Bypass Vulnerability in IBM TS3100/TS3200 Web User Interface https://www.trustwave.com/spiderlabs/advisories/TWSL2011-018.txt Published: 2011-12-20 Version: 1.0 Vendor: IBM http://www.ibm.com Product: TS3100/TS3200 Tape Library...

ZDI-11-351 : WellinTech KingView HistoryServer.exe Opcode 3 Parsing Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-351 : WellinTech KingView HistoryServer.exe Opcode 3 Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-351 December 22, 2011 - -- CVE ID: CVE-2011-4536 - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - --...

Asterisk SIP processing security vulnerabilities

DoS, information leakage...

Novell Sentinel Log Manager <=1.2.0.1 Path Traversal

Vuln: Path Traversal Application: Sentinel Log Manager Vendor: Novell Version affected: = 1.2.0.1 Website: http://www.novell.com/products/sentinel-log-manager/ Discovered By: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it The latest version of Sentinel Log Manager...