[SECURITY] Fedora 22 Update: nodejs-is-my-json-valid-2.12.4-1.fc22

A JSONSchema validator that uses code generation to be extremely fast...

PT-2017-6396

Name of the Vulnerable Software and Affected Versions validator versions prior to 2.0.0 Description The issue allows remote attackers to bypass the cross-site scripting XSS filter via hex-encoded characters. This may result in a cross-site scripting vulnerability. The xss function removes the wor...

PT-2017-5760

Name of the Vulnerable Software and Affected Versions: validator versions prior to 1.1.0 Description: The issue allows remote attackers to bypass the cross-site scripting XSS filter via nested forbidden strings. Several cross-site scripting vulnerabilities are present due to bypasses discovered i...

PT-2017-5759

Name of the Vulnerable Software and Affected Versions: validator module versions prior to 1.1.0 Description: The issue allows remote attackers to bypass the cross-site scripting XSS filter. This is achieved via vectors related to UI redressing, which is a technique used to trick users into...

PT-2017-5758

Name of the Vulnerable Software and Affected Versions: validator module versions prior to 1.1.0 Description: The issue allows remote attackers to bypass the cross-site scripting XSS filter via a crafted javascript URI. This could potentially lead to malicious script execution. Recommendations: Fo...

[SECURITY] Fedora 23 Update: nodejs-is-my-json-valid-2.12.4-1.fc23

A JSONSchema validator that uses code generation to be extremely fast...

Regular Expression Denial of Service

Overview The jshamcrest package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in to the emailAddress validator. Proof of concept var js = require'jshamcrest' var emailAddress = new js.JsHamcrest.Matchers.emailAddress; var genstr =...

Multiple XSS Filter Bypasses

Overview Versions of validator prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the denylist-based filter. Proof of Concept Various inputs that could bypass the filter were discovered: Improper parsing of nested tags: This is a test...

Updated struts packages fix CVE-2015-0899

Updated struts packages fix security vulnerability: The Validator in Apache Struts 1.1 and later contains a function to efficiently define rules for input validation across multiple pages during screen transitions. This function contains a vulnerability where input validation may be bypassed. Whe...

Updated jsoup package fixes security vulnerability

Jsoup before 1.8.3 was vulnerable to a possible XSS issue in the validator, related to how it handled tags without a closing '' when reaching EOF CVE-2015-6748...

Debian DLA-292-1 : libstruts1.2-java security update

The Validator in Apache Struts 1.1 and later contains a function to efficiently define rules for input validation across multiple pages during screen transitions. This function contains a vulnerability where input validation may be bypassed. When the Apache Struts 1 Validator is used, the web...

DLA-292-1 libstruts1.2-java - security update

Bulletin has no description...

DEBIAN-CVE-2015-5144

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an 1 email message to the EmailValidator, a ...

PYSEC-2015-21

validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service CPU consumption via unspecified vectors...

PYSEC-2015-10

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an 1 email message to the EmailValidator, a ...

PYSEC-2015-10

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an 1 email message to the EmailValidator, a ...

CVE-2015-5144

CVE-2015-5144 affects Django prior to 1.4.21, 1.5.x–1.6.x, 1.7.x prior to 1.7.9, and 1.8.x prior to 1.8.3. The root cause is an incorrect regular expression in built‑in validators, enabling remote attackers to inject arbitrary headers and perform HTTP response splitting via newline characters in ...

PT-2015-6780

Name of the Vulnerable Software and Affected Versions Django versions 1.8.0 through 1.8.2 Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, via unspecified vectors. This is related to the validators.URLValidator in Django. Recommendations Fo...

UBUNTU-CVE-2015-5144

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an 1 email message to the EmailValidator, a ...

Seasar S2Struts vulnerable to input validation bypass

Overview Seasar S2Struts provided by The Seasar Foundation is a software framework for developing Java web applications. Seasar S2Struts is vulnerable to an issue contained in the Apache Struts 1 Validator, because S2Struts 1.2.x uses Apache Struts 1.2.x, and S2Struts 1.3.x uses Apache Struts...