CVE-2018-1999022

PEAR HTMLQuickForm version 3.2.14 contains an eval injection CWE-95 vulnerability in HTMLQuickForm's getSubmitValue method, HTMLQuickForm's validate method, HTMLQuickFormhierselect's setOptions method, HTMLQuickFormelement's findValue method, HTMLQuickFormelement's prepareValue method. that can...

CVE-2018-1999022

PEAR HTMLQuickForm version 3.2.14 contains an eval injection CWE-95 vulnerability in HTMLQuickForm's getSubmitValue method, HTMLQuickForm's validate method, HTMLQuickFormhierselect's setOptions method, HTMLQuickFormelement's findValue method, HTMLQuickFormelement's prepareValue method. that can...

CVE-2018-1999022

The CVE-2018-1999022 entry concerns PEAR HTML_QuickForm version 3.2.14, where an eval injection vulnerability exists in multiple methods (getSubmitValue, validate, hierselect _setOptions, element _findValue, element _prepareValue). The described exploit could lead to information disclosure, data ...

PT-2018-15201

Name of the Vulnerable Software and Affected Versions PEAR HTML QuickForm versions 3.2.14 and earlier Description The issue concerns an eval injection that can lead to possible information disclosure, impact on data integrity, and execution of arbitrary code. This can be exploited via a specially...

CVE-2018-1999022: Improper Control of Generation of Code

PEAR HTMLQuickForm version 3.2.14 contains an eval injection CWE-95 vulnerability in HTMLQuickForm's getSubmitValue method, HTMLQuickForm's validate method, HTMLQuickFormhierselect's setOptions method, HTMLQuickFormelement's findValue method, HTMLQuickFormelement's prepareValue method. that can...

Fedora 26 : composer (2018-8b35c531db)

Version 1.6.4 - 2018-04-13 - Security fixes in some edge case scenarios, recommended update for all users - Fixed regression in version guessing of path repositories - Fixed removing aliased packages from the repository, which might resolve some odd update bugs - Fixed updating of package URLs fo...

openSUSE Security Update : php7 (openSUSE-2017-994)

This update for php7 fixes the following issues : - CVE-2016-10397: parseurl can be bypassed to return fake host. bsc1047454 - CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of service attack by injectinglong form variables, related to main/phpvariables. bsc1048100 -...

Security update for php7 (important)

This update for php7 fixes the following issues: - CVE-2016-10397: parseurl can be bypassed to return fake host. bsc1047454 - CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of service attack by injectinglong form variables, related to main/phpvariables. bsc1048100 -...

MGASA-2017-0293 Updated php-pear-CAS package fixes security vulnerability

It was discovered that php-pear-CAS contained a possible authentication bypass in validateCAS20...

Updated php-pear-CAS package fixes security vulnerability

It was discovered that php-pear-CAS contained a possible authentication bypass in validateCAS20...

PT-2017-19435

Name of the Vulnerable Software and Affected Versions php-pear-CAS affected versions not specified Description A possible authentication bypass was discovered in the validateCAS20 function of php-pear-CAS. Recommendations At the moment, there is no information about a newer version that contains ...

Fedora 26 : php-pear-CAS (2017-2f3096ba16)

Changes in version 1.3.5 - Security Fixes : - Fix possible authentication bypass in validateCAS20 228 Gregory Boddin - Bug Fixes : - Fix file permissions non-executable 177 Remi Collet - Fixed translations Greek and Japanese 192 ikari7789 - Fix errors under phpdbg 204 MasonM - Fix logout...

CVE-2016-10397

In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:[email protected]/ and evil.example.com:[email protected]/ inputs to the parseurl...

FreeBSD : pear-Horde_Image -- remote code execution vulnerability (a7003121-56bf-11e7-8e66-08606e46faad)

Michael J Rubinsky reports : The fist vulnerability CVE-2017-9774 is a Remote Code Execution vulnerability and is exploitable by a logged in user sending a maliciously crafted GET request to the Horde server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

FreeBSD : pear-Horde_Image -- DoS vulnerability (00e4050b-56c1-11e7-8e66-08606e46faad)

Michael J Rubinsky reports : The second vulnerability CVE-2017-9773 is a DOS vulnerability. This only affects Horde installations that do not have a configured image handling backend, and thus use the 'Null' image driver. It is exploitable by a logged in user clicking on a maliciously crafted URL...

pear-Horde_Image -- DoS vulnerability

Michael J Rubinsky reports: The second vulnerability CVE-2017-9773 is a DOS vulnerability. This only affects Horde installations that do not have a configured image handling backend, and thus use the "Null" image driver. It is exploitable by a logged in user clicking on a maliciously crafted URL...

[SECURITY] Fedora 26 Update: php-pear-PHP-CodeSniffer-3.0.1-1.fc26

PHPCodeSniffer provides functionality to verify that code conforms to certain standards, such as PEAR, or user-defined...

Arbitrary shell execution

Security Advisory - This release contains a fix for a security advisory related to the improper handling of a shell command - A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option - All version 3 users are encouraged to upgrad...

Fedora 24 : php-pear-CAS (2017-d9d620366e)

Changes in version 1.3.5 - Security Fixes : - Fix possible authentication bypass in validateCAS20 228 Gregory Boddin - Bug Fixes : - Fix file permissions non-executable 177 Remi Collet - Fixed translations Greek and Japanese 192 ikari7789 - Fix errors under phpdbg 204 MasonM - Fix logout...

Fedora Update for php-pear-CAS FEDORA-2017-d9d620366e

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...