CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2012-6137 – subscription-manager: rhn-migrate-classic-to-rhsm missing SSL certificate verification
https://notcve.org/view.php?id=CVE-2012-6137
rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials. rhn-migrate-classic-to-rhsm tool en Red Hat subscription-manager no verifica el certificado de servidor X.509 en Red Hat Network Classic cuando se está migrando a Certificate-based Red Hat Network, lo que permite a atacantes remotos "man-in-the-middle" obtener información sensible como credenciales de usuario. • http://osvdb.org/93058 http://rhn.redhat.com/errata/RHSA-2013-0788.html http://secunia.com/advisories/53330 http://www.securityfocus.com/bid/59674 http://www.securitytracker.com/id/1028520 https://bugzilla.redhat.com/show_bug.cgi?id=885130 https://exchange.xforce.ibmcloud.com/vulnerabilities/84020 https://access.redhat.com/security/cve/CVE-2012-6137 • CWE-255: Credentials Management Errors •
CVSS: 7.1EPSS: 1%CPEs: 43EXPL: 0CVE-2012-5689 – bind: denial of service when processing queries and with both DNS64 and RPZ enabled
https://notcve.org/view.php?id=CVE-2012-5689
ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record. ISC BIND v9.8.x hasta 9.8.4-P1 y v9.9.x hasta v9.9.2-P1, en ??ciertas configuraciones que implican DNS64 con una zona de política de respuesta que carece de una regla de reescritura AAAA, permite a atacantes remotos provocar una denegación de servicio (aserción fracaso y salida llamado demonio) a través de una consulta para un registro AAAA. • http://rhn.redhat.com/errata/RHSA-2013-0550.html http://www.isc.org/software/bind/advisories/cve-2012-5689 http://www.ubuntu.com/usn/USN-2693-1 https://kb.isc.org/article/AA-00855 https://access.redhat.com/security/cve/CVE-2012-5689 https://bugzilla.redhat.com/show_bug.cgi?id=903417 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2012-1703 – mysql: unspecified DoS vulnerability related to Server Optimizer (CPU Apr 2012)
https://notcve.org/view.php?id=CVE-2012-1703
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer, a different vulnerability than CVE-2012-1690. Vulnerabilidad no especificada en el componente MySQL Server en Oracle MySQL 5.1.61 y versiones anteriores y 5.5.21 y versiones anteriores, permite a usuarios remotos autenticados afectar la disponibilidad a través de vectores desconocidos relacionados con Server Optimizer, una vulnerabilidad diferente a CVE-2012-1690. • http://rhn.redhat.com/errata/RHSA-2012-1462.html http://secunia.com/advisories/48890 http://secunia.com/advisories/49179 http://secunia.com/advisories/51309 http://secunia.com/advisories/53372 http://security.gentoo.org/glsa/glsa-201308-06.xml http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html http://www.securityfocus.com/bid/53058 http://www.securitytracker.com/id?1026934 https://access.redh •
CVSS: 4.3EPSS: 0%CPEs: 32EXPL: 0CVE-2012-0867 – postgresql: MITM due improper x509_v3 CN validation during certificate verification
https://notcve.org/view.php?id=CVE-2012-0867
PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters. PostgreSQL v8.4.x antes de v8.4.11, v9.0.x antes de v9.0.7, y v9.1.x antes de v9.1.3 trunca el nombre común a sólo 32 caracteres en la verificación de los certificados SSL, lo que permite a atacantes remotos falsificar conexiones cuando el nombre de host es exactamente de 32 caracteres. • http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html http://rhn.redhat.com/errata/RHSA-2012-0678.html http://secunia.com/advisories/49273 http://www.debian.org/security/2012/dsa-2418 http://www.mandriva.com/security/advisories?name=MDVSA-2012:026 http://www.postgresql.org/about/news/1377 http://www.postgresql.org/docs/8.4/static/release-8-4-11.html http://www.postgresql.org/docs/9.0/static/release-9-0-7.html http://www.postgresql.org/docs/9.1&#x • CWE-20: Improper Input Validation CWE-295: Improper Certificate Validation •