 |
|
|
|
Межсайтовый скриптинг в библиотеке Microsoft AntiXSS
дополнено с 11 января 2012 г. | | Опубликовано: |  | 20 января 2012 г. | | Источник: |  | MICROSOFT | | SecurityVulns ID: |  | 12138 | | Тип: |  | библиотека | | Опасность: |  | 5/10 | | Описание: |  | Межсайтовый скриптинг при парсинге HTML. |
| Затронутые продукты: |  | MICROSOFT : AntiXSS 4.0 | | CVE: |  | CVE-2012-0007 (The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascading Style Sheets (CSS) escaped character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML input, aka "AntiXSS Library Bypass Vulnerability.") |
| Утечка информации в Xpra | | Опубликовано: | | 20 января 2012 г. | | Источник: | | BUGTRAQ | | SecurityVulns ID: | | 12146 | | Тип: | | локальная | | Опасность: | | 4/10 | | Описание: | | Возможен доступ к неинициализированным фрагментам памяти. |
Учетная запись по умолчанию в Cisco TelePresence System Integrator / Cisco IP Video Phone E20
дополнено с 21 ноября 2011 г. | | Опубликовано: | | 20 января 2012 г. | | Источник: | | BUGTRAQ | | SecurityVulns ID: | | 12051 | | Тип: | | удаленная | | Опасность: | | 6/10 | | Описание: | | По-умолачанию разрешена учетная запись root со стандартным паролем. |
| Повышение привилегий в Cisco Digital Media Manager | | Опубликовано: | | 20 января 2012 г. | | Источник: | | BUGTRAQ | | SecurityVulns ID: | | 12147 | | Тип: | | локальная | | Описание: | | Возможен доступ к административным функциям по прямым URL. |
| Затронутые продукты: | | CISCO : Digital Media Manager 5.2 | | CVE: | | CVE-2012-0329 (Cisco Digital Media Manager 5.2.2 and earlier, and 5.2.3, allows remote authenticated users to execute arbitrary code via vectors involving a URL and an administrative resource, aka Bug ID CSCts63878.) |
| Уязвимости безопасности в perl | | Опубликовано: | | 20 января 2012 г. | | Источник: | | BUGTRAQ | | SecurityVulns ID: | | 12148 | | Тип: | | библиотека | | Опасность: | | 5/10 | | Описание: | | Возможно внедрение кода через eval в конструкторе в модуле Digest. Однобайтовое переполнение буфера в decode_xs. |
| Затронутые продукты: | | PERL : perl 5.15 | | CVE: | | CVE-2011-3597 (Eval injection in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.) | | | | CVE-2011-2939 (Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.) |
| Уязвимости безопасности в Apache Tomcat | | Опубликовано: | | 20 января 2012 г. | | Источник: | | BUGTRAQ | | SecurityVulns ID: | | 12149 | | Тип: | | удаленная | | Опасность: | | 6/10 | | Описание: | | DoS, утечка информации. |
| Затронутые продукты: | | APACHE : Tomcat 6.0 | | | | APACHE : Tomcat 7.0 | | CVE: | | CVE-2012-0022 (Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.) | | | | CVE-2011-3375 (Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.) |
| Многочисленные уязвимости безопасности в библиотеке OpenSSL | | Опубликовано: | | 20 января 2012 г. | | Источник: | | BUGTRAQ | | SecurityVulns ID: | | 12150 | | Тип: | | библиотека | | Опасность: | | 7/10 | | Описание: | | Двойное освобождение памяти, обход защиты, утечка информации, DoS условия. |
| Затронутые продукты: | | OPENSSL : OpenSSL 1.0 | | CVE: | | CVE-2012-0050 (OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS applications, which allows remote attackers to cause a denial of service via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4108.) | | | | CVE-2012-0027 (The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.) | | | | CVE-2011-4619 (The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors.) | | | | CVE-2011-4576 (The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.) | | | | CVE-2011-4354 (crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.) | | | | CVE-2011-4109 (Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.) | | | | CVE-2011-4108 (The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.) |
|
|
|
|
|
|
|
|
