1109 matches found
CVE-2016-1000338
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of...
BD Pyxis
1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Public exploits are available. Vendor : Becton, Dickinson and Company BD Equipment : Certain BD Pyxis Products Vulnerability : Reusing a Nonce 2. RISK EVALUATION Successful exploitation of this vulnerability could allow data traffic manipulation,...
CVE-2015-4412
BSON injection vulnerability in the legal? function in BSON bson-ruby gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service resource consumption or inject arbitrary data via a crafted string...
PT-2018-4378
Name of the Vulnerable Software and Affected Versions bson-ruby gem versions prior to 3.0.4 Description The issue allows remote attackers to cause a denial of service or inject arbitrary data via a crafted string, exploiting a BSON injection vulnerability in the legal? function. Recommendations F...
CVE-2015-4412: Uncontrolled Resource Consumption
BSON injection vulnerability in the legal? function in BSON bson-ruby gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service resource consumption or inject arbitrary data via a crafted string...
Huawei Mate 9 Pro NFC Module Buffer Overflow Vulnerability
Huawei Mate 9 Pro is a smartphone from Chinese company Huawei Huawei. The Huawei Mate 9 Pro NFC module suffers from a buffer overflow vulnerability, which is due to a lack of parameter checking in the program. An attacker can use a device such as an NFC reader to inject malicious data into the...
Design/Logic Flaw
A remote, unauthenticated attacker may be able to execute code by exploiting a use-after-free defect found in older versions of PHP through injection of crafted data via specific PHP URLs within the context of the J-Web process. Affected releases are Juniper Networks Junos OS: 12.1X46 versions...
PT-2018-8406
Name of the Vulnerable Software and Affected Versions Undertow versions 1.3.x before 1.3.31.Final Undertow versions 1.4.x before 1.4.17.Final Undertow versions 2.x before 2.0.0.Alpha2 Description The issue allows invalid characters in the query string and path parameters. This could be exploited ...
Microsoft Edge Elevation of Privilege Vulnerability (CNVD-2018-00520)
Microsoft Windows 10 and Windows Server 2016 are both products of Microsoft Corporation USA. The former is an operating system for personal computers and the latter is a server operating system.Edge is one of the web browsers that comes with the system. Edge in Microsoft Windows suffers from an...
ALPINE-CVE-2017-15896
Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSLread due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption...
PT-2017-14274
Name of the Vulnerable Software and Affected Versions Node.js affected versions not specified Description The issue concerns a TLS handshake failure due to the use of SSL read, allowing an active network attacker to send application data to Node.js using the TLS or HTTP2 modules, bypassing TLS...
Code injection
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files made to look legitimate. IBM X-Force ID: 123850...
X (Formerly Twitter): OS Command Execution on User's PC via CSV Injection
Summary: Twitter is vulnerable to CSV Injection. If an attacker can successfully exploit this, then they will compromise the PC of the user. The injection point is via a tweet on the main twitter.com site while the retrieval point is via the “Export Data” option on the analytics site. Description...
CVE-2017-1210
IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files made to look legitimate. IBM X-Force ID: 123850...
CVE-2017-1210
CVE-2017-1210 affects IBM Daeja ViewONE Professional, Standard & Virtual (versions 4.1.5.1 and 5.0.2 as noted in the IBM bulletin; specifically 4.1.5 and 5.0.0/Virtual 5.0.0 area referenced for remediation). The issue allows an unauthenticated attacker to inject data into log files that appear le...
PT-2017-12350
Name of the Vulnerable Software and Affected Versions IBM Daeja ViewONE Professional, Standard & Virtual versions 4.1.5.1 and 5.0.2 Description The issue allows an unauthenticated attacker to inject data into log files, making them appear legitimate. Recommendations For version 4.1.5.1, at the...
The vulnerability of the WPA2 protocol, related to errors in managing STK-keys, allows access to encrypted information transmitted over a wireless network.
The vulnerability of the WPA2 protocol, which provides security for Wi-Fi wireless networks, is related to errors in the management of cryptographic keys. Exploiting this vulnerability allows a perpetrator within the range of a Wi-Fi network to gain access to encrypted information transmitted ove...
aplaceofmind.ubc.ca XSS vulnerability
Open Bug Bounty ID: OBB-325752 Description| Value ---|--- Affected Website:| aplaceofmind.ubc.ca Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Student Result or Employee Database <= 1.6.3 - Auth Bypass
The Student Result or Employee Database WordPress plugin was affected by an Auth Bypass security vulnerability. curl -i -s -k -X 'POST' -H 'User-Agent: Mozilla/5.0' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'X-Requested-With: XMLHttpRequest' -H 'Referer:...
