CVE-2017-17512

sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument...

PT-2017-14823

Name of the Vulnerable Software and Affected Versions sensible-utils versions prior to 0.0.11 Description The issue allows remote attackers to conduct argument-injection attacks via a crafted URL. This is possible because the sensible-browser in sensible-utils does not validate strings before...

CVE-2017-17512: Improper Neutralization of Special Elements in Output Used by a Downstream Component

sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument...

Remote Code Execution (RCE)

brooklyn-utils-common is vulnerable to remote code execution RCE attacks. The library by default allows the unmarshalling of Java types available to that classpath. This allows an attacker to inject and execute arbitrary code by passing a malicious yaml file to the application...

CVE-2017-5078

Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as have an...

Command injection

Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as have an...

UBUNTU-CVE-2017-5078

Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as have an...

CVE-2017-5078

Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as have an...

CVE-2017-5078

CVE-2017-5078 is listed in Arch Linux ASA-201707-4 as a vulnerability in qt5-webengine (Chromium-based) before 5.9.1-1, described as an arbitrary command execution via a possible command injection in the mailto handling component of the Chromium browser. The advisory indicates multiple issues in ...

CVE-2017-5078: Undefined Security Weakness

Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as have an...

PT-2017-4336

Name of the Vulnerable Software and Affected Versions: OpenCV versions 3.3 and earlier Description: The issue is related to an integer overflow in the utils.cpp component of the OpenCV library, specifically in the FillUniColor and FillUniGray functions. These functions do not check the input...

Fedora Update for dmtx-utils FEDORA-2017-8f27031c8f

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 26 Update: dmtx-utils-0.7.4-4.fc26

libdmtx is open source software for reading and writing Data Matrix 2D bar-codes on Linux, Unix, OS X, Windows, and mobile devices. At its core libdmtx is a shared library, allowing C/C++ programs to use its capabilities without restrictions or overhead. The included utility programs, dmtxread an...

com.a9ski.brooklyn:apache-brooklyn-ldap-provider (1.0.0), eu.seaclouds-project:seaclouds-qa (1.0.0) +57 more potentially affected by CVE-2016-8737 via org.apache.brooklyn:brooklyn-utils-common (>=0.7.0-incubating, <=0.9.0)

org.apache.brooklyn:brooklyn-utils-common MAVEN version =0.7.0-incubating, =0.2.0, =0.2.0, =0.3.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating, =0.9.0 and more Source cves: CVE-2016-8737 Source advisory: SNYK:JAVA-ORGAPACHEBROOKLYN-99621...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server. PoC Attacker puts something like this int...

CVE-2017-12871

The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector IV...

CVE-2017-12874

The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities...

CVE-2017-12870

SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers...

CVE-2017-12870

SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers...

CVE-2017-12868

The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation...