Eclipse Jetty Server Fake Pipeline Request Security Bypass Vulnerability - Linux

Eclipse Jetty Server is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eclipse:jetty";...

CVE-2018-7787

In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTTP GET request...

PT-2018-18283

Name of the Vulnerable Software and Affected Versions: Schneider Electric U.motion Builder versions prior to 1.3.4 Description: The issue is caused by improper validation of input of the context parameter in an HTTP GET request. Recommendations: For versions prior to 1.3.4, update to version 1.3....

PT-2018-18175

Name of the Vulnerable Software and Affected Versions PAN-OS versions 8.0.0 through 8.0.10 Description A Cross-Site Scripting XSS issue exists in the PAN-OS URL filtering “continue page” due to improper validation of specific request parameters. This allows an attacker to inject arbitrary...

CVE-2018-0373

A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected system. The vulnerability is due to improper...

Improper validation on OAuth2 token endpoint (NC-SA-2018-003)

Improper validation of input allowed an attacker with access to the OAuth2 refresh token to obtain new tokens...

Security Bulletin: IBM TRIRIGA Application Platform Cross Site Request Forgery Vulnerability (CVE-2016-0348)

Summary Unauthenticated requests can be made to a vulnerable web application, which then performs unauthorized action on behalf of the attacker. Vulnerability Details CVEID: CVE-2016-0348 DESCRIPTION: IBM Tririga is vulnerable to cross-site request forgery, caused by improper validation of...

Security Bulletin: IBM Content Navigator is potentially vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2015-1888)

Summary IBM Content Navigator is potentially vulnerable to cross-site scripting, caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2015-1888 IBM Content Navigator is vulnerable to cross-site scripting. The vulnerability is caused by improper validation of user...

Security Bulletin: IBM Forms Experience Builder vulnerable to CSRF when configured with non default settings (CVE-2016-2884)

Summary A cross-site request forgery attack is possible when configured with non default settings, caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2016-2884 DESCRIPTION: IBM Forms Experience Builder is vulnerable to cross-site request forgery, when configure...

Security Bulletin: IBM MQ Appliance potential execution of arbitrary commands (CVE-2016-5879)

Summary There is potential for malicious users to execute arbitrary commands due to improper validation of the input parameters. Vulnerability Details CVEID: CVE-2016-5879 DESCRIPTION: IBM MQ Appliance could allow a local attacker to execute arbitrary commands on the system, caused by improper...

Security Bulletin: WebSphere DataPower Appliance V2.1 Validation Vulnerability CVE-2015-1893

Summary A vulnerability in IBM® WebSphere DataPower XC10 Appliance V2.1 has confidentiality and integrity impact. Vulnerability Details CVE-ID: CVE-2015-1893 DESCRIPTION: IBM® WebSphere DataPower XC10 Appliance could allow a remote attacker to hijack a valid user's session, caused by improper...

Input validation

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command...

CVE-2018-1103

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command...

CVE-2018-1103

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command...

CVE-2018-1103

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command...

CVE-2017-5445: Improper Validation of Array Index

A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and...

Arbitrary File Write

zt-zip is vulnerable to arbitrary file write. The application does not properly validate the destination filepath during compressed file extraction, allowing a malicious user to overwrite files in the target directory...

Liberapay: A single user can subscribe a community multiple times

There is no proper validation while subscribing for a community. A user can subscribe a single community multiple times. Steps to recreate: Step 1: Open any community Step 2: Click on subscribe button Step 3: Capture the POST request and submit it multiple times Step 4: Check the subscription cou...

Samba Printer Server spoolss Denial Of Service (CVE-2018-1050)

A Denial Of Service vulnerability exists in Samba Printer Service. The vulnerability is due to improper validation of user input...

Input validation

Huawei DP300 V500R002C00; RP200 V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have a numeric errors vulnerability. An unauthenticated, remote attacker may send specially crafted SCC...