CVE-2018-11403

CVE-2018-11403 affects DomainMod v4.09.03, with an XSS flaw in assets/edit/account-owner.php using the oid parameter. Root cause: insufficient input sanitization/execution of user-supplied oid enabling script injection. Impact: cross-site scripting in affected sessions; CVSS v3.0 base score 5.4 (...

CVE-2018-11403: Improper Neutralization of Input During Web Page Generation

DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter...

SD-WAN SNMP OID

This article will describe how to retrieve OID's from SD-WAN MIB file. As the other 3rd party SNMP tools needs OID to receive alerts from the SD-WAN for monitoring...

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are caused by an operation that goes beyond the buffer boundaries in memory, allowing an attacker to trigger a service failure.

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird arise from an operation that goes beyond the buffer boundaries in memory when reading certificates from the disk. Exploiting these vulnerabilities can allow a malicious actor to cause service failures using...

MatrixSSL <= 3.7.2 Multiple Vulnerabilities

MatrixSSL is prone multiple vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2017-1000417

MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs e.g. in ExtKeyUsage extension on X.509 certificates...

CVE-2017-1000417

MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs e.g. in ExtKeyUsage extension on X.509 certificates...

Spoofing

MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs e.g. in ExtKeyUsage extension on X.509 certificates...

CVE-2017-1000417

MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs e.g. in ExtKeyUsage extension on X.509 certificates...

CVE-2017-1000417

MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs e.g. in ExtKeyUsage extension on X.509 certificates...

CVE-2017-1000417

MatrixSSL 3.7.2 is affected by a collision-prone OID comparison logic that can allow spoofing of OIDs (such as in the ExtKeyUsage extension) in X.509 certificates. The root cause is the OID comparison logic used by the library. The available connected documents confirm the vulnerability and affec...

CVE-2017-1000417: Improper Certificate Validation

MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs e.g. in ExtKeyUsage extension on X.509 certificates...

WordPress Oturia Smart Google Code Inserter Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Oturia Smart Google Code Inserter plugin is used in one of the meta-tagging validation to add plug-ins. A SQL...

Sql injection

SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in the context of the web server. The saveGoogleAdWords function in smartgooglecode.php did not use prepared statements and did not sanitize...

CVE-2017-5257

In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows or guesses the SNMP read/write RW community string can insert XSS strings in certain SNMP OIDs which will execute in the context of the currently-logged on user...

CVE-2017-5262

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only RO community string has access to sensitive information by OID reference...

CVE-2017-5262

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only RO community string has access to sensitive information by OID reference...

CVE-2017-5262: Exposure of Sensitive Information to an Unauthorized Actor

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only RO community string has access to sensitive information by OID reference...

Cisco Wireless LAN Controller Simple Network Management Protocol Memory Leak Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco Wireless LAN Controllers could allow an authenticated, remote attacker to cause an affected device to restart, resulting in a denial of service DoS condition. The vulnerability is due to a memory leak that occurs on...

Fixing HPKP with Certificate Constraints

This is the third post in my series on HPKP. In my first post I declared HPKP dead, and in my second post I explored the possibility of fixing it by introducing pin revocation. Today I will consider an entirely different approach to make HPKP much safer, by changing how it’s activated. In my...