CVE-2017-11181

In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable...

Red Hat FreeIPA SubjectAltNames Improperly Checked Vulnerability

Red Hat FreeIPA is an integrated security information management solution from Red Hat, Inc. The solution provides an easy-to-manage identity, policy and audit IPA suite for Linux and Unix computer networks. A security vulnerability exists in Red Hat FreeIPA version 4.4.0. A remote attacker could...

Cuvva: Subdomain take over oh-no.cuvva.co and ohno.cuvva.co

Cuvva has an old EV certificate which lists a very large number of subject alternative names SANs, as listed below. These were included because we anticipated potentially wanting to use these hostnames in the future and it was free to add them. Very few of the hostnames actually exist, and those...

CVE-2016-4467

The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when using the SChannel-based security layer,...

CVE-2017-7723

XSS exists in Easy WP SMTP before 1.2.5, a WordPress Plugin, via the e-mail subject or body...

Multiple SQL Injection Vulnerabilities in Zaoyang City Shanshui Digital Website Building System

Zaoyang Shanshui digital website builder system is a website builder system. SQL injection vulnerability exists in the index.php and subject.php pages of the Zaoyang City Shanshui Digital website builder system, as the program fails to filter user-submitted data, allowing attackers to exploit the...

jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name

It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

CVE-2017-5673

In the Kunena extension 5.0.2 through 5.0.4 for Joomla!, the forum message subject aka topic subject accepts JavaScript, leading to XSS. Six files are affected: crypsis/layouts/message/item/default.php, crypsis/layouts/message/item/top/default.php, crypsis/layouts/message/item/bottom/default.php,...

CVE-2016-6890

Heap-based buffer overflow in MatrixSSL before 3.8.6 allows remote attackers to execute arbitrary code via a crafted Subject Alt Name in an X.509 certificate...

Contenido v4.9.11 - (Backend) Multiple XSS Vulnerabilities

Document Title: =============== Contenido v4.9.11 - Backend Multiple XSS Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1928 Release Date: ============= 2016-10-10 Vulnerability Laboratory ID VL-ID: ====================================...

FRticket Ticket System Stored Cross-Site Scripting Vulnerability

Frticket is a popular ticketing system. FRticket Ticket System subject parameter-stored cross-site scripting vulnerability. An attacker can inject malicious scripts via this vulnerability...

The vulnerability of Apache Subversion software allows a malicious intruder to compromise the confidentiality and integrity of protected information.

The vulnerability exists at the Serf RA level in Apache Subversion, due to incorrect processing of group characters contained in the CN Common Name field or the subjectAltName field of X.509 certificates. Exploiting this vulnerability allows a malicious actor to replace servers by using specially...

CVE-2016-4803

CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject...

MIT Kerberos 5 kadmind memory leak vulnerability

MIT Kerberos 5 also known as krb5 is the United States Massachusetts Institute of Technology MIT developed a set of network authentication protocols, which uses a client/server structure, and the client and server side can be authenticated to each other i.e., double authentication to prevent...

The vulnerability of the PHP interpreter allows attackers to execute arbitrary code.

The vulnerability of the phpstrReplaceInSubject function ext/standard/string.c in the PHP interpreter is related to errors in the code. Exploiting this vulnerability allows an attacker to execute arbitrary code by entering special parameters remotely...

Threat Outbreak Alert RuleID19347: Email Messages Distributing Malicious Software on November 12, 2015

Medium Alert ID: 42055 First Published: 2015 November 12 19:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID19347 may contain the following files: Name |...

OpenSSL - Alternative Chains Certificate Forgery

OpenSSL - Alternative Chains Certificate Forgery !/usr/bin/env ruby encoding: ASCII-8BIT By Ramon de C Valle. This work is dedicated to the public domain. require 'openssl' require 'optparse' require 'socket' Version = 0, 0, 1 Release = nil class String def hexdumpstream=$stdout 0.stepbytesize - ...

CVE-2002-1648

Cross-site request forgery CSRF vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL with modified sendto and subject parameters...

Google to Disable Weak SSLv3 and RC4 Protocols to Boost Internet Security

It is finally time to say GoodBye to the old and insecure Web security protocols. Citing the long history of weaknesses in the Secure Sockets Layer SSL 3.0 cryptographic protocol and the RC4 Cipher Suite, Google plans to disable support for both SSLv3 as well as RC4 stream cipher in its front-end...

DEBIAN-CVE-2015-3908

Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...