RUSTSEC-2023-0073 Infinite decoding loop through specially crafted payload

The Candid library causes a Denial of Service while parsing a specially crafted payload with empty data type. For example, if the payload is record ; empty and the canister interface expects record then the rust candid decoder treats empty as an extra field required by the type. The problem with...

Candid Security Breach

Candid is an Interface Description Language IDL used to interact with containers running on Internet computers. A security vulnerability exists in Candid versions 0.9.0 through 0.9.10, which stems from a denial of service when the Candid library parses a specially crafted payload with a data type...

PT-2023-32574 · Dfx +1 · Dfx +1

Name of the Vulnerable Software and Affected Versions: Candid versions 0.9.0 through 0.9.9 dfx versions 0.14.4 through 0.15.2-beta.0 Description: The Candid library causes a Denial of Service while parsing a specially crafted payload with empty data type. For example, if the payload is record ;...

CandidATS 2.1.0 - Cross-Site Request Forgery (Add Admin)

CandidATS 2.1.0 - Cross-Site Request Forgery Add Admin Title: CandidATS 2.1.0 - Cross-Site Request Forgery Add Admin Date: 2020-02-21 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/u/auieo/profile/ Software Link: https://sourceforge.net/projects/candidats/files/Version 2.1.0...

CandidATS 2.1.0 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications Title: CandidATS 2.1.0 - Cross-Site Request Forgery Add Admin Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/u/auieo/profile/ Software Link: https://sourceforge.net/projects/candidats/files/Version 2.1.0 Tested on Ubuntu...

CandidATS 2.1.0 - Cross-Site Request Forgery (Add Admin)

Title: CandidATS 2.1.0 - Cross-Site Request Forgery Add Admin Date: 2020-02-21 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/u/auieo/profile/ Software Link: https://sourceforge.net/projects/candidats/files/Version 2.1.0 Tested on Ubuntu 19/Kali Rolling The Candid ATS Web...

CANDID 'view.php' SQL Injection and Cross Site Scripting Vulnerabilities

CANDID is prone to sql injection and cross site scripting vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CANDID Remote Version Detection

Check for the presence of CANDID. This script sends an HTTP GET request and tries to check for the presence of CANDID from the response. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

CVE-2010-4978

Cross-site scripting XSS vulnerability in image/view.php in CANDID allows remote attackers to inject arbitrary web script or HTML via the imageid parameter...

CVE-2010-4979

SQL injection vulnerability in image/view.php in CANDID allows remote attackers to execute arbitrary SQL commands via the imageid parameter...

Sql injection

SQL injection vulnerability in image/view.php in CANDID allows remote attackers to execute arbitrary SQL commands via the imageid parameter...

CVE-2010-4978

Cross-site scripting XSS vulnerability in image/view.php in CANDID allows remote attackers to inject arbitrary web script or HTML via the imageid parameter...

CVE-2010-4979

CANDID is reported vulnerable to an SQL Injection in image/view.php via the image_id parameter (CVE-2010-4979). The OpenVAS note corroborates that CANDID is prone to SQLi (and XSS in related checks). The CVSS base score listed is 7.5 (HIGH) with network access, low attack complexity, and no authe...

CVE-2010-4978

Cross-site scripting XSS vulnerability in image/view.php in CANDID allows remote attackers to inject arbitrary web script or HTML via the imageid parameter...

CVE-2010-4978

CVE-2010-4978 is a Cross-site scripting (XSS) vulnerability in CANDID, affecting the image/view.php handler. The vulnerability is triggered via the image_id parameter, allowing remote attackers to inject arbitrary web script or HTML. Public sources in the connected documents corroborate: the code...

CVE-2010-4979

SQL injection vulnerability in image/view.php in CANDID allows remote attackers to execute arbitrary SQL commands via the imageid parameter...

CANDID - imageview.php?image_id SQL Injection

CANDID - imageview.php?imageid SQL Injection source: https://www.securityfocus.com/bid/41216/info CANDID is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacke...

CANDID - '/image/view.php?image_id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/41216/info CANDID is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based authentication...

CANDID - '/image/view.php?image_id' SQL Injection

source: https://www.securityfocus.com/bid/41216/info CANDID is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based authentication...

CANDID - imageview.php?image_id Cross-Site Scripting

CANDID - imageview.php?imageid Cross-Site Scripting source: https://www.securityfocus.com/bid/41216/info CANDID is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an...