541 matches found
CVE-2018-8032
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting XSS attack in the default servlet/services...
CVE-2017-7658
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x all non HTTP/1.x configurations, and 9.4.x all HTTP/1.x configurations, when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was...
Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Network Active Bypass (CVE-2015-5229, CVE-2015-8776)
Summary OpenSSL vulnerabilities were found in IBM Security Network Active Bypass. IBM Security Network Active Bypass has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-5229 DESCRIPTION: GNU C Library glibc is vulnerable to a denial of service, caused by the return of memory...
Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability in GDS component of IBM® InfoSphere® Master Data Management - Collaborative Edition (CVE-2014-0114)
Summary Apache Struts 1.X could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An attacker could exploit this vulnerability by using the class parameter of an ActionForm object to manipulate the ClassLoade...
CVE-2018-8013
Apache Batik 1.x before 1.10 is vulnerable to information disclosure via deserializing a subclass of AbstractDocument, where inputStream-derived class name is used to invoke a no-arg constructor. The fix is to validate the class type before newInstance during deserialization; remediation is to up...
Mautic Information Disclosure Vulnerability
Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. A security vulnerability exists in Mautic version 1.x and version 2.x prior to 2.13.0. An attacker could exploit the vulnerability to retrieve contact...
CVE-2014-1398
CVE-2014-1398 affects Drupal: the Entity API module (7.x-1.x) before 7.x-1.3 may let remote authenticated users bypass access restrictions on comment, user and node statistics properties via unspecified vectors. Connected documents confirm fixes in 7.x-1.3 (e.g., Fedora updates for drupal7-entity...
Design/Logic Flaw
lyadmin 1.x has XSS via the configWEBSITETITLE parameter to the /admin.php?s=/admin/config/groupsave.html URI...
CVE-2018-7547
lyadmin 1.x has XSS via the configWEBSITETITLE parameter to the /admin.php?s=/admin/config/groupsave.html URI...
CVE-2018-7547
lyadmin 1.x has XSS via the configWEBSITETITLE parameter to the /admin.php?s=/admin/config/groupsave.html URI...
Cloudera Data Science Workbench Elevation of Privilege Vulnerability
Cloudera Data Science Workbench CDSW is a suite of data science platforms from US-based Cloudera. The platform provides fast, easy and secure self-service data science support for organizations. A security vulnerability exists in CDSW 1.2.0 prior to version 1.x. The vulnerability can be exploited...
CVE-2017-17432
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service system crash or application crash via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value...
CVE-2017-17432
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service system crash or application crash via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value...
CVE-2017-5636
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node...
Clientside Validation - Critical - Arbitary PHP Execution - DRUPAL-SA-CONTRIB-2017-072
The Clientside Validation module enables you to have clientside Javascript validation on your forms. The module does not sufficiently validate parameters of a POST request made when validating a CAPTCHA. For the 1.x version of this module, this vulnerability is mitigated by the fact that the...
[SECURITY] Fedora 26 Update: python-gstreamer1-1.12.0-1.fc26
This module contains PyGObject overrides to make it easier to write applications that use GStreamer 1.x in Python...
CVE-2017-7191
The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service use-after-free and possibly execute arbitrary code via unspecified vectors...
Information disclosure
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml...