DLA-2141-1 yubikey-val - security update

Bulletin has no description...

[SECURITY] [DLA 2141-1] yubikey-val security update

Package : yubikey-val Version : 2.27-1+deb8u1 CVE ID : CVE-2020-10184 CVE-2020-10185 The following CVEs were reported against yubikey-val. CVE-2020-10184 The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a...

PT-2020-12005

Name of the Vulnerable Software and Affected Versions BWA DiREX-Pro version 1.2181 Description The issue allows full path disclosure via an invalid name array parameter to the "val soft.php3" API endpoint. Recommendations For BWA DiREX-Pro version 1.2181, consider restricting access to the "val...

PT-2020-12004

Name of the Vulnerable Software and Affected Versions BWA DiREX-Pro version 1.2181 Description The issue allows remote attackers to discover passwords via a direct request to "val users.php3". Recommendations For BWA DiREX-Pro version 1.2181, consider restricting access to the "val users.php3"...

CVE-2019-7340

POST - Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filterQueryterms0val' parameter value in the view filter filter.php because proper filtration is omitted...

PT-2019-18545

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.4 Description A Cross Site Scripting XSS issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable filterQueryterms0val parameter value in the "view filter" filter.php because prop...

CVE-2019-7340: Improper Neutralization of Input During Web Page Generation

POST - Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filterQueryterms0val' parameter value in the view filter filter.php because proper filtration is omitted...

CVE-2017-18283

Possible memory corruption when Read Val Blob Req is received with invalid parameters in Snapdragon Mobile in version QCA9379, SD 210/SD 212/SD 205, SD 625, SD 835, SD 845, SD 850, SDA660...

CVE-2017-18283

Possible memory corruption when Read Val Blob Req is received with invalid parameters in Snapdragon Mobile in version QCA9379, SD 210/SD 212/SD 205, SD 625, SD 835, SD 845, SD 850, SDA660...

CVE-2017-18283

CVE-2017-18283 describes a memory corruption issue in Qualcomm Snapdragon mobile platform components triggered by Read Val Blob Req with invalid parameters. Affected are Snapdragon variants QCA9379 and SD series: 210/212/205, 625, 835, 845, 850, and SDA660. The vulnerability context in the connec...

CVE-2017-18283: Improper Restriction of Operations within the Bounds of a Memory Buffer

Possible memory corruption when Read Val Blob Req is received with invalid parameters in Snapdragon Mobile in version QCA9379, SD 210/SD 212/SD 205, SD 625, SD 835, SD 845, SD 850, SDA660...

PT-2018-6800

Name of the Vulnerable Software and Affected Versions: Snapdragon Mobile versions QCA9379, SD 210/SD 212/SD 205, SD 625, SD 835, SD 845, SD 850, SDA660 Description: The issue is related to possible memory corruption when a Read Val Blob Req is received with invalid parameters. Recommendations: Fo...

CVE-2014-4932

Cross-site scripting XSS vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php...

CVE-2014-4932: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php...

PT-2018-4230

Name of the Vulnerable Software and Affected Versions Wordfence Security plugin versions prior to 5.1.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the val parameter to the "whois.php" endpoint. Recommendations For versions prior...

joyplus-cms SQL Injection Vulnerability

joyplus-cms joy video is an open source video backend management system based on PHP and MySQL. The system has a video resource acquisition , user feedback management , automatic address resolution and message push management and other functions . A SQL injection vulnerability exists in joyplus-c...

CVE-2018-14389

joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...

CVE-2018-14389

joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...

CVE-2018-14389

joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...

CVE-2018-14389

joyplus-cms 1.6.0 has SQL Injection via the manager/adminajax.php val parameter...