Re: 0-day Denial of Service in IPsec-Tools

Posted by Christos Zoulas on May 20

— Subject: [FD] 0-day Denial of Service in IPsec-Tools

| Denial of Service in IPsec-Tools
| Vulnerability Report
| May 19, 2015
|
| Product: IPsec-Tools
| Version: 0.8.2
| Website: http://ipsec-tools.sourceforge.net/
| CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
|
| IPsec-Tools is vulnerable to a 0-day exploit that I made available yesterday. It is a null dereference crash in
racoon in gssapi.c. It requires HAVE_GSSAPI to be set, which is…

CVE-2014-6211

The command-line scripts in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack 2 through 8, when debugging is configured, do not properly restrict the logging of personal data, which allows local users to obtain sensitive information by reading a log file.

CVE-2015-0740

Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus28826.