CVE-2019-10219

The CVE-2019-10219 entry affects Hibernate Validator: SafeHtml validator annotation fails to sanitize HTML comments/instructions, enabling XSS in affected code paths. Affected CP4S versions are 1.7.2.0, 1.8.0.0, and 1.8.1.0. Remediation is to upgrade to Cloud Pak for Security 1.9.0.0 per IBM guid...

CVE-2013-4751

php-symfony2-Validator has loss of information during serialization...

Session fixation

php-symfony2-Validator has loss of information during serialization...

CVE-2013-4751

php-symfony2-Validator has loss of information during serialization...

CVE-2013-4751

The CVE-2013-4751 entry concerns Symfony2 Validator, where a caching path (e.g., APCache or other CacheInterface implementations) leads to loss of serialization data in the Mapping Cache. The consequence described in connected documents is that when the validator’s configuration is loaded from th...

CVE-2018-5735

The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar...

DEBIAN-CVE-2018-5735

The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar...

Improper Authentication in Auth0.AuthenticationApi

Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens...

CVE-2019-18413

In TypeStack class-validator 0.10.2, validate input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not...

CVE-2019-18413

In TypeStack class-validator 0.10.2, validate input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not...

Sql injection

In TypeStack class-validator 0.10.2, validate input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not...

CVE-2019-18413

In TypeStack class-validator 0.10.2, validate input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not...

TypeStack class-validator SQL Injection Vulnerability

TypeStack class-validator is a class validator. A SQL injection vulnerability exists in TypeStack class-validator version 0.10.2, which can be exploited to bypass security checks by injecting attribute entries into user input to override internal attribute entries with the same name...

CVE-2019-18413

CVE-2019-18413 affects TypeStack class-validator 0.10.2, where validate() input validation can be bypassed because internal attributes can be overwritten with a conflicting name. This bypass enables attackers to inject malicious input potentially leading to SQL Injection or XSS. The description n...

PT-2019-15396 · Typestack · Class-Validator

Name of the Vulnerable Software and Affected Versions: class-validator versions 0.10.2 through 0.13.x Description: The validate input validation in class-validator can be bypassed because certain internal attributes can be overwritten via a conflicting name. Although there is an optional...

Alkacon OpenCMS 10.5.x - Cross-Site Scripting Vulnerability (2)

Exploit for multiple platform in category web applications Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Alkacon OpenCms Site Management Exploit Author: Aetsu Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/opencms-core Version: 10.5.x Tested on: 10.5.5...

Alkacon OpenCMS 10.5.x - Cross-Site Scripting (2)

Alkacon OpenCMS 10.5.x - Cross-Site Scripting 2 Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Alkacon OpenCms Site Management Google Dork: N/A Date: 18/07/2019 Exploit Author: Aetsu Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/opencms-core Version:...

CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...

GHSA-6FPP-RGJ9-8RWC Deserialization of untrusted data in FasterXML jackson-databind

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when ehcache is used because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup, leading to remote code execution...

FasterXML jackson-databind input validation error vulnerability

FasterXML jackson-databind is a generic data binding package for Jackson 2.x. An input validation error vulnerability exists in versions of FasterXML jackson-databind prior to 2.9.9.2. The vulnerability stems from SubTypeValidator.java not handling default input correctly when using ehcache. An...