Computer Security
[EN] securityvulns.ru no-pyccku


apr / Apache mod_autoindex DoS
updated since 16.05.2011
Published:21.05.2011
Source:
SecurityVulns ID:11676
Type:remote
Threat Level:
5/10
Description:CPU resources exhaustion on request to indexed files with long names.
Affected:APACHE : apr 1.4
CVE:CVE-2011-1928 (The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.)
 CVE-2011-0419 (Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.)
Original documentdocumentMANDRIVA, [ MDVSA-2011:095 ] apr (21.05.2011)
 documentMaksymilian Arciemowicz, Multiple Vendors libc/fnmatch(3) DoS (incl apache poc) (16.05.2011)
 documentDEBIAN, [SECURITY] [DSA 2237-1] apr security update (16.05.2011)

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:21.05.2011
Source:
SecurityVulns ID:11681
Type:remote
Threat Level:
5/10
Description:PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.
Affected:APACHE : Struts 2.2
 WORDPRESS : Easy Contact 0.1
 OPENSYMPHONY : XWork 2.2
 PHPCAPTCHA : PHPCaptcha 2.0
 TWIKI : TWiki 5.0
 ZEACOM : Zeacom Chat Application 5.0
 CUBELABS : PHP Calendar Basic 2.3
CVE:CVE-2011-2088 (XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.)
 CVE-2011-1838 (Multiple cross-site scripting (XSS) vulnerabilities in TemplateLogin.pm in TWiki before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via the origurl parameter to a (1) view script or (2) login script.)
 CVE-2010-0217 (Zeacom Chat Server before 5.1 uses too short a random string for the JSESSIONID value, which makes it easier for remote attackers to hijack sessions or cause a denial of service (Chat Server crash or Tomcat daemon crash) via a brute-force attack.)
Original documentdocumentHigh-Tech Bridge Security Research, HTB22981: Multiple XSS (Cross Site Scripting) vulnerabilities in PHP Calendar Basic (21.05.2011)
 documentDaniel Clemens, CVE-2010-0217 - Zeacom Chat Server JSESSIONID weak SessionID Vulnerability (21.05.2011)
 documentNetsparker Advisories, XSS vulnerability in TWiki < 5.0.2 (21.05.2011)
 documentlists_(at)_senseofsecurity.com, PHPCaptcha / Securimage 2.0.2 - Authentication Bypass - SOS-11-007 (21.05.2011)
 documentmarian.ventuneac_(at)_gmail.com, Apache Struts 2, XWork, OpenSymphony WebWork Java Class Path Information Disclosure (21.05.2011)
 documentMustLive, Уязвимости в Easy Contact для WordPress (21.05.2011)

Cisco Unified Operations Manager multiple security vulnerabilities
Published:21.05.2011
Source:
SecurityVulns ID:11682
Type:remote
Threat Level:
5/10
Description:Crossite scripting, SQL injection.
Affected:CISCO : Unified Operations Manager 8.0
 CISCO : Unified Operations Manager 8.5
CVE:CVE-2011-0966 (Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, aka Bug ID CSCto35577.)
 CVE-2011-0962 (Cross-site scripting (XSS) vulnerability in CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in the Common Services Device Center in Cisco Unified Operations Manager (CUOM) before 8.6 allows remote attackers to inject arbitrary web script or HTML via the tag parameter, aka Bug ID CSCto12712.)
 CVE-2011-0961 (Cross-site scripting (XSS) vulnerability in cwhp/device.center.do in the Help servlet in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the device parameter, aka Bug ID CSCto12704.)
 CVE-2011-0960 (Multiple SQL injection vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to execute arbitrary SQL commands via (1) the CCMs parameter to iptm/PRTestCreation.do or (2) the ccm parameter to iptm/TelePresenceReportAction.do, aka Bug ID CSCtn61716.)
 CVE-2011-0959 (Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to inject arbitrary web script or HTML via (1) the extn parameter to iptm/advancedfind.do, (2) the deviceInstanceName parameter to iptm/ddv.do, the (3) cmd or (4) group parameter to iptm/eventmon, the (5) clusterName or (6) deviceName parameter to iptm/faultmon/ui/dojo/Main/eventmon_wrapper.jsp, or the (7) ccmName or (8) clusterName parameter to iptm/logicalTopo.do, aka Bug ID CSCtn61716.)
Original documentdocumentlists_(at)_senseofsecurity.com, Cisco Unified Operations Manager Multiple Vulnerabilities - SOS-11-006 (21.05.2011)

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod