CVE-2019-18413

In TypeStack class-validator 0.10.2, validate input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not...

CVE-2019-18413

In TypeStack class-validator 0.10.2, validate input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not...

Sql injection

In TypeStack class-validator 0.10.2, validate input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not...

TypeStack class-validator SQL Injection Vulnerability

TypeStack class-validator is a class validator. A SQL injection vulnerability exists in TypeStack class-validator version 0.10.2, which can be exploited to bypass security checks by injecting attribute entries into user input to override internal attribute entries with the same name...

CVE-2019-18413

CVE-2019-18413 affects TypeStack class-validator 0.10.2, where validate() input validation can be bypassed because internal attributes can be overwritten with a conflicting name. This bypass enables attackers to inject malicious input potentially leading to SQL Injection or XSS. The description n...

6ix (0.0.0-canary.0), 9ight (>=0.0.0-canary.0, <=0.0.0-canary.6) +3456 more potentially affected by CVE-2019-18413 via class-validator (>=0.3.2, <=0.13.2)

class-validator NPM version =0.3.2, =0.0.0-canary.0, =0.0.1, =1.0.4, =4.2.3, =2.7.0, =1.1.0, =1.1.0, =1.0.0, =0.0.1, =0.1.0, =0.0.2, =0.0.1, =0.0.13 and more Source cves: CVE-2019-18413 Source advisory: MEND:CVE-2019-18413...

CVE-2019-18413

In TypeStack class-validator 0.10.2, validate input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not...

CVE-2019-18413: Improper Neutralization of Input During Web Page Generation

In TypeStack class-validator 0.10.2, validate input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not...

PT-2019-15396 · Typestack · Class-Validator

Name of the Vulnerable Software and Affected Versions: class-validator versions 0.10.2 through 0.13.x Description: The validate input validation in class-validator can be bypassed because certain internal attributes can be overwritten via a conflicting name. Although there is an optional...

CVE-2019-18413

In TypeStack class-validator 0.10.2, validate input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not...

Alkacon OpenCMS 10.5.x - Cross-Site Scripting Vulnerability (2)

Exploit for multiple platform in category web applications Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Alkacon OpenCms Site Management Exploit Author: Aetsu Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/opencms-core Version: 10.5.x Tested on: 10.5.5...

Alkacon OpenCMS 10.5.x - Cross-Site Scripting (2)

Alkacon OpenCMS 10.5.x - Cross-Site Scripting 2 Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Alkacon OpenCms Site Management Google Dork: N/A Date: 18/07/2019 Exploit Author: Aetsu Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/opencms-core Version:...

CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...

GHSA-6FPP-RGJ9-8RWC Deserialization of untrusted data in FasterXML jackson-databind

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when ehcache is used because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup, leading to remote code execution...

FasterXML jackson-databind input validation error vulnerability

FasterXML jackson-databind is a generic data binding package for Jackson 2.x. An input validation error vulnerability exists in versions of FasterXML jackson-databind prior to 2.9.9.2. The vulnerability stems from SubTypeValidator.java not handling default input correctly when using ehcache. An...

UBUNTU-CVE-2019-14379

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup, leading to remote code execution...

Unauthorized view fragment access

Jenkins uses the Stapler web framework to render its UI views. These views are frequently composed of several view fragments, enabling plugins to extend existing views with more content. In some cases attackers could directly access a view fragment containing sensitive information, bypassing any...

Slanger Message handler&request validator command execution vulnerability

Slanger is an open source server implementation of the Pusher protocol written in Ruby.Message handler&request validator is one of the message handler and request validator . A security vulnerability exists in the Message handler&request validator in Slanger version 0.6.0. A remote attacker can...

Slanger Arbitrary command execution

Slanger 0.6.0 is affected by Remote Code Execution RCE. The impact is A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is Message handler & request validator. The attack vector is Remote unauthenticated. The fixed version is after commit...

GHSA-RG32-M3HF-772V Slanger Arbitrary command execution

Slanger 0.6.0 is affected by Remote Code Execution RCE. The impact is A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is Message handler & request validator. The attack vector is Remote unauthenticated. The fixed version is after commit...