6118 matches found
DEBIAN-CVE-2016-1000352
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider...
DEBIAN-CVE-2016-1000346
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are...
CVE-2018-3756
Hyperledger Iroha versions v1.0beta and v1.0.0beta-1 are vulnerable to transaction and block signature verification bypass in the transaction and block validator allowing a single node to sign a transaction and/or block multiple times, each with a random nonce, and have other validating nodes...
Olive Tree Ftp Server application for Android Information Disclosure Vulnerability
Olive Tree Ftp Server application for Android is an application for building FTP servers on the Android platform. A security vulnerability exists in version 1.32 of the Olive Tree Ftp Server application for Android-based platforms, which stems from the program failing to store data securely. No...
SQL Injection Vulnerability in xycms Logistics and Transportation System v1.9
Jiangsu Xinyue Technology hereinafter referred to as "Xinyue Technology", a pioneer in the domestic website building industry, is a technology enterprise with independent intellectual property rights. xycms logistics and transportation company website building system v1.9 SQL injection...
PT-2018-10651
Name of the Vulnerable Software and Affected Versions The Olive Tree Ftp Server application version 1.32 Description The issue concerns insecure data storage. Specifically, a username and password are stored in the /data/data/com.theolivetree.ftpserver/shared prefs/com.theolivetree.ftpserver...
EasyService Billing Cross-Site Request Forgery Vulnerability
EasyService Billing is a PHP-based service-oriented consumer business management system . A cross-site request forgery vulnerability exists in EasyService Billing version 1.0. A remote attacker can exploit this vulnerability to perform unauthorized operations with...
CVE-2018-8871
In Delta Electronics Automation TPEditor version 1.89 or prior, parsing a malformed program file may cause heap-based buffer overflow vulnerability, which may allow remote code execution...
E-Sic Authentication Bypass Vulnerability
E-Sic is a Brazilian electronic system for citizen information. An authentication bypass vulnerability exists in the /index aka login URI in E-Sic version 1.0. An attacker can exploit this vulnerability to bypass authentication and gain access to the panel with the 'username' and 'password'...
SkyCaiji Cross-Site Request Forgery Vulnerability
SkyCaiji is a set of PHP and MySQL based data collection software. A cross-site request forgery vulnerability exists in SkyCaiji version 1.2. A remote attacker can exploit this vulnerability to add an administrator user...
iBall Baton ADSL2+ Authentication Bypass Vulnerability
The iBall Baton ADSL2+ Home Router is a router from iBall India. An authentication bypass vulnerability exists in the iBall Baton ADSL2+ Home Router version FWiB-LR7011A1.0.2. An attacker can exploit the vulnerability by logging into the admin panel with the help of building URLs with .cgi...
Code Execution Vulnerability in Microcms (viicms) v1.0
VIICMS is a third-party platform that specializes in providing marketing and promotion services for WeChat public accounts. A code execution vulnerability exists in micro cms viicms v1.0. The vulnerability stems from the program failing to effectively filter the parameter array when changing the...
The vulnerability in the implementation of the Internet Key Exchange protocol (IKEv1) in Cisco IOS and IOS XE operating systems allows a attacker to cause a service failure.
The vulnerability of the Internet Key Exchange IKEv1 protocol in Cisco IOS and IOS XE operating systems exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures using specially crafted IKEv1 packets...
CloudBees Jenkins HTML Publisher Plugin Path Traversal Vulnerability
CloudBees Jenkins is the U.S. CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and a number of timed tasks . HTML Publisher Plugin is used in one of the plug-ins used to...
CloudBees Jenkins Google Login Plugin Session Fixation Vulnerability
CloudBees Jenkins is a set of Java-based continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and a number of timed tasks.Google Login Plugin is used in one of the support for the use of Google accounts to log in to Jenkins...
clustercoding Blog Master Pro CSV Injection Vulnerability
clustercoding Blog Master Pro is a personal blog system based on Laravel framework. The system has a blog management , comment management and site configuration file management and other functions . A CSV injection vulnerability exists in clustercoding Blog Master Pro version 1.0. An attacker can...
CVE-2018-10259
An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user...
UBUNTU-CVE-2017-12108
An exploitable integer overflow vulnerability exists in the xlspreparseWorkSheet function of libxls 1.4 when handling a MULBLANK record. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this...
UBUNTU-CVE-2018-5382
The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47...
