Apache httpd mod_cache_socache Denial of Service (CVE-2018-1303)

A denial-of-service vulnerability exists in Apache httpd. The vulnerability is due to improper validation of the headers in HTTP requests...

CVE-2018-4991

Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable improper certificate validation vulnerability (CVE-2018-4991) that could lead to a security bypass. Affected product: Creative Cloud Desktop. Root cause: improper certificate validation. Impact: security b...

Important: patch

Issue Overview: Malicious patch files cause ed to execute arbitrary commands GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitable via a...

Important: patch

Issue Overview: Malicious patch files cause ed to execute arbitrary commands GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitable via a...

PT-2018-9954 · Wavpack +3 · Wavpack +3

Name of the Vulnerable Software and Affected Versions: WavPack versions 5.1.0 and earlier Description: An issue in WavPack for W64 input can cause out-of-bounds writes due to insufficient validation of unknown chunk sizes in the ParseWave64HeaderConfig function, located in wave64.c. This is relat...

Unauthorised Changes Due To Missing Permission Checks

favorite plugin is vulnerable to unauthorized changes. The users can easily set other user's favorite status since it fails to validate the authorization of a user to writes other user's favorite status...

[SECURITY] [DLA 1348-1] patch security update

Package : patch Version : 2.6.1-3+deb7u1 CVE ID : CVE-2018-1000156 Debian Bug : 894993 It was discovered that there was an input validation vulnerability in the patch1 utility where an ed1 script embedded in a regular input file could result in arbitrary code execution. This was reported by Rache...

CVE-2018-9127

Botan 2.2.0 - 2.4.0 fixed in 2.5.0 improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must alrea...

CVE-2018-5474

Philips Intellispace Portal all versions 7.0.x and 8.0.x have an input validation vulnerability that could allow a remote attacker to execute arbitrary code or cause the application to crash...

CVE-2017-16772

Improper input validation vulnerability in SYNOPHOTOFlickrMultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authenticated users to execute arbitrary codes via the progid parameter...

Unspecified vulnerability in authentikat-jwt

authentikat-jwt aka com.jason-goodwin/authentikat-jwt is a JWT Scala implementation. A security vulnerability exists in the JsonWebToken.validate method of the main/scala/authentikat/jwt/JsonWebToken.scala file in authentikat-jwt 0.4.5 and earlier. No details of the vulnerability are provided at...

CVE-2018-1000125

inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JWTDecoder.decode that can result in a JWT that is decoded and thus implicitly validated even if it lacks a valid signature. This attack...

ASP.NET Core Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when a Kestrel web application fails to validate web requests. An attacker who successfully exploited this vulnerability could perform HTML injection attacks. To exploit the vulnerability, an attacker could send a specially crafted request, containin...

Input validation

brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 Oct 29 2016 contains a Missing SSL certificate validation vulnerability in The libraries core functionality is affected. that can result in Exposes the user to man-in-the-middle attacks...

Apache Traffic Server 6.x < 6.2.2 / 7.x < 7.1.2 Host Header and Line Folding Vulnerability

According to its banner, the version of Apache Traffic Server running on the remote host is 6.x prior to 6.2.2 or 7.x prior to 7.1.2. It is, therefore, affected by an input-validation vulnerability related to handling 'Host' headers and line folding that allows a remote attacker to cause the wron...

[SECURITY] [DLA 1278-1] librsvg security update

Package : librsvg Version : 2.36.1-2+deb7u3 CVE ID : CVE-2018-1000041 It was discovered that there was an input validation vulnerability in the librsvg renderer library that could result in data being leaked to remote attackers via a specially-crafted file. For Debian 7 "Wheezy", this issue has...

CVE-2017-17532

examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-2722

DP300 V500R002C00,TE60 with software V100R001C01, V100R001C10, V100R003C00, V500R002C00 and V600R006C00,TP3106 with software V100R001C06 and V100R002C00,ViewPoint 9030 with software V100R011C02, V100R011C03,eCNS210TD with software V100R004C10,eSpace 7950 with software V200R003C00 and...

CVE-2017-2722

DP300 V500R002C00,TE60 with software V100R001C01, V100R001C10, V100R003C00, V500R002C00 and V600R006C00,TP3106 with software V100R001C06 and V100R002C00,ViewPoint 9030 with software V100R011C02, V100R011C03,eCNS210TD with software V100R004C10,eSpace 7950 with software V200R003C00 and...

CVE-2017-2722

CVE-2017-2722 concerns an input validation vulnerability across multiple Huawei products (e.g., DP300, TP3106, ViewPoint 9030, eSpace series, eSpace U1981, eSpace IAD, eSpace 7950, etc.). The issue, described in the initial CVE entry, arises from insufficient input validation, which can be trigge...