ncaahallofchampions.org XSS vulnerability

Open Bug Bounty ID: OBB-651680 Description| Value ---|--- Affected Website:| ncaahallofchampions.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Security Bulletin: IBM Security SiteProtector System is affected by Apache HTTP Server vulnerabilities

Summary IBM Security SiteProtector System has addressed the following vulnerabilities in Apache HTTP Server. Vulnerability Details CVEID: CVE-2017-12613 DESCRIPTION: Apache Portable Runtime APR could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds array...

DEBIAN-CVE-2018-14343

In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ASN.1 BER dissector could crash. This was addressed in epan/dissectors/packet-ber.c by ensuring that length values do not exceed the maximum signed integer...

Heap-Based Buffer Overflow

libcurl is vulnerable to heap-based buffer overflow. The vulnerability is due to not using upload buffer size for scratch buffer in Curlsmtpescapeeob in lib/smtp.c. It is possible only when an attacker can get control over the data transmitted over SMTP using curl with certain settings i.e., use ...

CVE-2018-0500

Curlsmtpescapeeob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings i.e., use of a nonstandard --limit-rate argument or CURLOPTBUFFERSIZE...

Brute Force Attacks

Microsoft.AspNetCore.Identity is vulnerable to brute force attacks. The application does not validate whether the lockout limit for incorrect login attempts has been reached, allowing a malicious user to be able to conduct a brute force attack...

CURL-CVE-2018-0500 SMTP send heap buffer overflow

curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer. When sending data over SMTP, curl allocates a separate "scratch area" on the heap to be able to escape the uploaded data properly if the uploaded data contains data that requires it. The si...

SMTP send heap buffer overflow

curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer. When sending data over SMTP, curl allocates a separate "scratch area" on the heap to be able to escape the uploaded data properly if the uploaded data contains data that requires it. The si...

PT-2018-8862

Name of the Vulnerable Software and Affected Versions curl versions 7.54.1 through 7.60.0 Description The issue is related to a heap-based buffer overflow in the Curl smtp escape eob function when curl transmits data over SMTP with certain settings, such as a nonstandard --limit-rate argument or...

CVE-2018-13049

The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php...

Sql injection

The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php...

CVE-2018-13049

The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php...

CVE-2018-13049

The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php...

PT-2018-11558

Name of the Vulnerable Software and Affected Versions GLPI versions 9.2.x through 9.3.0 Description The issue concerns SQL Injection in the constructSQL function, located in inc/search.class.php. This can be exploited by triggering a crafted LIMIT clause, for example, to front/computer.php...

CVE-2018-13049: Improper Neutralization of Special Elements used in an SQL Command

The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php...

Denial Of Service (DoS)

websockets is vulnerable to denial of service attacks. The application does not properly enforce a size limit when decompressing frames, allowing a malicious user to pass a zip bomb to the application to consume memory and crash it...

Microsoft Windows: Idle time limit (Remote Desktop Services)

This policy setting allows you to specify the maximum amount of time that an active Remote Desktop Services session can be idle without user input before it is automatically disconnected. If you enable this policy setting, you must select the desired time limit in the Idle session limit list...

Microsoft Windows: Time limit for disconnected sessions (Remote Desktop Services)

This policy setting allows you to configure a time limit for disconnected Remote Desktop Services sessions. You can use this policy setting to specify the maximum amount of time that a disconnected session remains active on the server. By default, Remote Desktop Services allows users to disconnec...

Denial of service

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit 100MB by default. The broker crashes due to the defect. AMQP protocols 0-10 and 1.0...

CVE-2018-8030

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit 100MB by default. The broker crashes due to the defect. AMQP protocols 0-10 and 1.0...