django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session’s identifier. (CVSS:5.8) (Last Update:2011-10-19)
Monthly Archives: October 2011
CVE-2011-4139
Django before 1.2.7 and 1.3.x before 1.3.1 uses a request’s HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request. (CVSS:5.0) (Last Update:2011-10-19)
CVE-2011-4140
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code. (CVSS:6.8) (Last Update:2011-10-19)
CVE-2011-4138
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL’s validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header. (CVSS:5.0) (Last Update:2011-10-19)
WatchGuard Extends Business Security with Virtualization
New WatchGuard XTMv Series Denotes New Line of Virtualized Firewalls
WatchGuard Strengthens Web Security Features
WatchGuard XCS Appliances Now Gain the Ability to Scan HTTPS Traffic
Security Vendor WatchGuard Continues Record Growth
Breaks All Time Company Record for Q3 Billings; Exceeds 15 Percent Year over Year Growth
Cisco TelePresence Video Communication Server Cross-Site Scripting Vulnerability
A vulnerability exists in Cisco TelePresence Video Communication Server (VCS) due to improper validation of user-controlled input to the web-based administrative interface. User-controlled input supplied to the login page via the HTTP User-Agent header is not properly sanitized for illegal or malicious content prior to being returned to the user in dynamically generated web content. A remote attacker could exploit this vulnerability to perform reflected cross-site scripting attacks.
Cisco IOS Software Smart Install Remote Code Execution Vulnerability
A vulnerability exists in the Smart Install feature of Cisco Catalyst Switches running Cisco IOS Software that could allow an unauthenticated, remote attacker to perform remote code execution on the affected device.
Cisco IOS Software IP Service Level Agreement Vulnerability
The Cisco IOS IP Service Level Agreement (IP SLA) feature contains a denial of service (DoS) vulnerability. The vulnerability is triggered when malformed UDP packets are sent to a vulnerable device. The vulnerable UDP port numbers depend on the device configuration. Default ports are not used for the vulnerable UDP IP SLA operation or for the UDP responder ports.