nodejs: Incorrect handling of certificate subject and issuer fields

A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries...

GitLab Arbitrary Data Validation

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to inject arbitrary data into the Incidents Timeline field...

nodejs: Incorrect handling of certificate subject and issuer fields

A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries...

Windows 10 Input Validation Error Vulnerability

Microsoft Windows 10 is a suite of operating systems for use on personal computers from the American company Microsoft. A security vulnerability exists in Windows 10 driver version 6.1316.1209. An attacker can inject arbitrary data frames independent of the network configuration...

Design/Logic Flaw

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration...

CVE-2020-26140

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration...

CVE-2020-26140: Use of a Broken or Risky Cryptographic Algorithm

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration...

PT-2021-12289

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.7 Description The issue allows a remote user to inject arbitrary data, which could cause the service to crash due to excess resource consumption. Recommendations For IBM Spectrum Protect...

CVE-2020-5023: Uncontrolled Resource Consumption

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 could allow a remote user to inject arbitrary data iwhich could cause the serivce to crash due to excess resource consumption. IBM X-Force ID: 193659...

Security Bulletin: Denial of Service vulnerability in IBM Spectrum Protect Plus (CVE-2020-5023)

Summary IBM Spectrum Protect Plus may be vulnerable to a denial of service attack when arbitrary data injection/parameter fuzzing is performed. Vulnerability Details CVEID: CVE-2020-5023 DESCRIPTION: IBM Spectrum Protect Plus could allow a remote user to inject arbitrary data iwhich could cause t...

Insecure Cryptography

typo3/cms is vulnerable to insecure cryptography. The vulnerability exists because it was possible to generate arbitrary checksums that allows the injection of arbitrary data...

Potential Remote Code Execution in TYPO3 with mediace extension

Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 9.1 CWE-325, CWE-20, CWE-200, CWE-502 Problem It has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message...

Sensitive Information Disclosure

It has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code HMAC-SHA1 and can lead to various attack chains as described below...

CVE-2018-20586: Improper Encoding or Escaping of Output

bitcoind and Bitcoin-Qt prior to 0.17.1 allow injection of arbitrary data into the debug log via an RPC call...

CVE-2018-20914: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files SEC-368...

PT-2019-10346

Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 70.0.23 Description: The issue allows OpenID providers to inject arbitrary data into cPanel session files. Recommendations: For versions prior to 70.0.23, update to version 70.0.23 or later to resolve the issue...

PT-2020-8672

Name of the Vulnerable Software and Affected Versions: bitcoind and Bitcoin-Qt versions prior to 0.17.1 Description: The issue allows injection of arbitrary data into the debug log via an RPC call. Recommendations: For versions prior to 0.17.1, update to version 0.17.1 or later to resolve the iss...

CVE-2015-4412

BSON injection vulnerability in the legal? function in BSON bson-ruby gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service resource consumption or inject arbitrary data via a crafted string...

PT-2018-4378

Name of the Vulnerable Software and Affected Versions bson-ruby gem versions prior to 3.0.4 Description The issue allows remote attackers to cause a denial of service or inject arbitrary data via a crafted string, exploiting a BSON injection vulnerability in the legal? function. Recommendations F...

CVE-2015-4412: Uncontrolled Resource Consumption

BSON injection vulnerability in the legal? function in BSON bson-ruby gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service resource consumption or inject arbitrary data via a crafted string...