Symfony Incorrect Access Control

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator...

GHSA-Q87V-Q8FW-GMJ5 Symfony Incorrect Access Control

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator...

CVE-2018-3776

Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log...

Zend Framework CSRF Vulnerability

Cross-site request forgery CSRF vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers...

GHSA-CQF7-FF9H-7967 Django ReDoS in validators.URLValidator

validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service CPU consumption via unspecified vectors...

GHSA-Q5QW-4364-5HHM Django Vulnerable to HTTP Response Splitting Attack

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an 1 email message to the EmailValidator, a ...

GHSA-CVVX-R33M-V7PQ Improper Input Validation in Apache Struts

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter...

GHSA-86VQ-8QHC-5RQW Apache Struts vulnerable to possible DoS attack when using URLValidator

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL...

Improper Authentication in Hibernate Validator

ReflectionHelper org.hibernate.validator.util.ReflectionHelper in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager JSM restrictions and execute restricted reflection calls via a crafted application...

biz.littlej.jreqs:jreqs-beanvalidation (0.1.2), br.com.caelum.stella:caelum-stella-hibernate-user-types (>=2.0, <=2.1.1) +764 more potentially affected by CVE-2014-3558 via org.hibernate:hibernate-validator (>=4.1.0.final, <=4.2.0.final)

org.hibernate:hibernate-validator MAVEN version =4.1.0.final, =2.0, =2.0, =3.5.0, =0.7.0.3, =0.3.1, =1.0, =1.16.0, =1.16.0, =1.0, =1.0.0, =1.0.4, =1.0.7, =1.5.8 and more Source cves: CVE-2014-3558 Source advisory: OSV:GHSA-845H-985R-JRQH...

ai.grakn.kgms:client (1.4.3), ai.grakn:client-java (>=1.4.1, <=1.4.3) +763 more potentially affected by CVE-2014-3558 via org.hibernate:hibernate-validator (>=4.3.0.final, <=4.3.1.final)

org.hibernate:hibernate-validator MAVEN version =4.3.0.final, =1.4.1, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =0.13.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =0.13.0, =0.13.0, =0.13.0, =1.4.1, =0.13.0, =0.13.0, =0.14.0 and more...

ai.grakn.kgms:client (1.4.3), ai.grakn:client-java (>=1.4.1, <=1.4.3) +763 more potentially affected by CVE-2014-3558 via org.hibernate:hibernate-validator (>=4.3.0.final, <=4.3.1.final)

org.hibernate:hibernate-validator MAVEN version =4.3.0.final, =1.4.1, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =0.13.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =0.13.0, =0.13.0, =0.13.0, =1.4.1, =0.13.0, =0.13.0, =0.14.0 and more...

ai.idylnlp:idylnlp-models-deeplearning (>=1.0.0, <=1.1.0), be.objectify:deadbolt-core_2.10 (>=2.2.0, <=2.4.3) +1192 more potentially affected by CVE-2014-3558 via org.hibernate:hibernate-validator (>=5.0.0.final, <=5.1.1.final)

org.hibernate:hibernate-validator MAVEN version =5.0.0.final, =1.0.0, =2.2.0, =2.4.0, =2.2.0, =2.4.0, =2.2.0, =2.4.0, =2.0.0, =4.0.0.final, =4.3.0-beta-3 - br.com.caelum:vraptor-musicjungle 4.0.0-beta-1 - br.com.ingenieux.dropwizard:dropwizard-envvar 0.0.1 -...

biz.littlej.jreqs:jreqs-beanvalidation (0.1.2), br.com.caelum.stella:caelum-stella-hibernate-user-types (>=2.0, <=2.1.1) +764 more potentially affected by CVE-2014-3558 via org.hibernate:hibernate-validator (>=4.1.0.final, <=4.2.0.final)

org.hibernate:hibernate-validator MAVEN version =4.1.0.final, =2.0, =2.0, =3.5.0, =0.7.0.3, =0.3.1, =1.0, =1.16.0, =1.16.0, =1.0, =1.0.0, =1.0.4, =1.0.7, =1.5.8 and more Source cves: CVE-2014-3558 Source advisory: GHSA-845H-985R-JRQH...

ai.idylnlp:idylnlp-models-deeplearning (>=1.0.0, <=1.1.0), be.objectify:deadbolt-core_2.10 (>=2.2.0, <=2.4.3) +1192 more potentially affected by CVE-2014-3558 via org.hibernate:hibernate-validator (>=5.0.0.final, <=5.1.1.final)

org.hibernate:hibernate-validator MAVEN version =5.0.0.final, =1.0.0, =2.2.0, =2.4.0, =2.2.0, =2.4.0, =2.2.0, =2.4.0, =2.0.0, =4.0.0.final, =4.3.0-beta-3 - br.com.caelum:vraptor-musicjungle 4.0.0-beta-1 - br.com.ingenieux.dropwizard:dropwizard-envvar 0.0.1 -...

GHSA-845H-985R-JRQH Improper Authentication in Hibernate Validator

ReflectionHelper org.hibernate.validator.util.ReflectionHelper in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager JSM restrictions and execute restricted reflection calls via a crafted application...

Improper Input Validation in Apache Struts

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting XSS attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899...

GHSA-5GGR-MPGW-3MGX Improper Input Validation in Apache Struts

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting XSS attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899...

Voting power of new validators not checked in updateValset function, Gravity.sol

Lines of code Gravity.solL276-L358 Vulnerability details Impact While the voting power of the current valset is checked when the checkValidatorSignatures function is called in updateValset, the power of the new valset is not. This could cause some functions to not work since whenever...

updateValset() Insufficient validation of new validator set may brick the contract

Lines of code Vulnerability details In Gravity.solupdateValset, while the signatures of the current validators are verified and = powerThreshold is checked, there is one important validation should be done: check the cumulative power of the new validator set to ensure the contract has sufficient...