PYSEC-2018-20

privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user== to /validate/check url. This vulnerability appears to have been fixed in 2.23.2...

Input validation

privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=&pass= to /validate/check url. This vulnerability appears to have been fixed in...

CVE-2018-1000809

privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=&pass= to /validate/check url. This vulnerability appears to have been fixed in...

Foxit Reader for Windows Memory Misreference Vulnerability (CNVD-2018-20647)

Foxit Reader for Windows is China's Foxit Foxit Software Corporation, a Windows-based platform for PDF document reader. A memory misreference vulnerability exists in the handling of the Validate event in Foxit Reader 9.2.0.9297 and earlier versions for Windows platforms, where the program fails t...

CVE-2018-1000809: Improper Input Validation

privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user= &pass= to /validate/check url. This vulnerability appears to have been fixed in...

PT-2018-9533

Name of the Vulnerable Software and Affected Versions privacyIDEA versions prior to 2.23.2 Description The issue is related to improper input validation in the token validation API, which can lead to a Denial-of-Service. This can be exploited via an HTTP request to the "/validate/check" API...

PT-2018-14091

Name of the Vulnerable Software and Affected Versions Foxit Reader version 9.0.1.5096 Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw...

Foxit Reader TextBox Validate Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

CVE-2018-16767

In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service application crash or possibly have unspecified other impact because of an unspecified "heap-buffer-overflow" condition in FunctionValidationContext::popAndValidateOperand...

PT-2018-13286

Name of the Vulnerable Software and Affected Versions Jorani version 0.6.5 Description An issue allows a user without permissions to read and modify sensitive information from the database via the startdate or enddate parameter to leaves/validate. This is due to SQL Injection, which is error-base...

CVE-2018-15918: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Jorani 0.6.5. SQL Injection error-based allows a user of the application without permissions to read and modify sensitive information from the database used by the application via the startdate or enddate parameter to leaves/validate...

CVE-2018-5542

F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server...

CVE-2018-1999022

PEAR HTMLQuickForm version 3.2.14 contains an eval injection CWE-95 vulnerability in HTMLQuickForm's getSubmitValue method, HTMLQuickForm's validate method, HTMLQuickFormhierselect's setOptions method, HTMLQuickFormelement's findValue method, HTMLQuickFormelement's prepareValue method. that can...

PT-2018-11537

Name of the Vulnerable Software and Affected Versions gpmf-parser version 1.1.2 Description A heap-based buffer over-read issue was discovered in the GPMF parser.c file, specifically in the GPMF Validate function. Recommendations For gpmf-parser version 1.1.2, consider disabling the GPMF Validate...

UBUNTU-CVE-2018-12108

An issue was discovered in Dropbox Lepton 1.2.1. The validateAndCompress function in validation.cc allows remote attackers to cause a denial of service SIGFPE and application crash via a malformed file...

CVE-2018-7248

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...

Design/Logic Flaw

The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment...

phpVirtualBox 5.2 Cross Site Request Forgery / Cross Site Scripting

Title: phpVirtualBox / CSRF - Stored XSS Date: 03/04/2018 Discovered by: @codexlynx Software Version: //lib/ajax.php" name="csrf" " / 2Stored XSS -------------------------------- Many fields don't sanitize inputs. This vulnerability could allow a user role escalation in the application. - POC:...

CVE-2013-7245

The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions and perform database dumps by leveraging failure to validate credentials, aka SAP Security Note 1927859...

PT-2018-4112

Name of the Vulnerable Software and Affected Versions SAP Sybase ASE version 15.7 before SP51 Description The issue allows remote attackers to bypass access restrictions and perform database dumps by leveraging failure to validate credentials. Recommendations For SAP Sybase ASE version 15.7 befor...