Design/Logic Flaw

An incorrect implementation of a local web server in eID client Windows version before 3.1.2, Linux version before 3.0.3 allows remote attackers to execute arbitrary code .cgi, .pl, or .php or delete arbitrary files via a crafted HTML page. This is a product from the Ministry of Interior of the...

CVE-2019-13028

The CVE-2019-13028 entry describes an issue in the eID client where a local web server is incorrectly implemented. Affects Windows versions before 3.1.2 and Linux versions before 3.0.3. The flaw allows remote attackers to run arbitrary code or delete arbitrary files via a crafted HTML page served...

CVE-2019-13028

An incorrect implementation of a local web server in eID client Windows version before 3.1.2, Linux version before 3.0.3 allows remote attackers to execute arbitrary code .cgi, .pl, or .php or delete arbitrary files via a crafted HTML page. This is a product from the Ministry of Interior of the...

DEBIAN-CVE-2019-7332

Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' aka Event ID parameter value in the view download download.php because proper filtration is omitted...

UBUNTU-CVE-2019-7332

Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' aka Event ID parameter value in the view download download.php because proper filtration is omitted...

CVE-2019-7332

Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' aka Event ID parameter value in the view download download.php because proper filtration is omitted...

PT-2019-18537 · Zoneminder +3 · Zoneminder +3

Name of the Vulnerable Software and Affected Versions: ZoneMinder versions prior to 1.32.4 Description: A Reflected Cross Site Scripting issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable eid parameter value in the "download.php" API endpoint, due to omitted...

Multiple vulnerabilities in extension "femanager" (femanager)

It is possible to bypass configured server side validation rules which allows an attacker to create frontend user records with invalid data. Also, the eID script allows an attacker to set various validators using GET parameters resulting in information disclosure of field values from the feusers...

CVE-2018-17394

SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter...

Sql injection

SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter...

eid-paris.com XSS vulnerability

Open Bug Bounty ID: OBB-626287 Description| Value ---|--- Affected Website:| eid-paris.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Lessons Learned from the Estonian National ID Security Flaw

Estonia recently suffered a major flaw in the security of their national ID card. This article discusses the fix and the lessons learned from the incident: In the future, the infrastructure dependency on one digital identity platform must be decreased, the use of several alternatives must be...

Change "User Name" text at login page

In order to avoid confusion for users we need to change the text on the StoreFront webpage from "User Name" to "eID" in order to match nomenclature in use at our university...

New windows malware can target smart cards for full remote access

If you think that having a USB Token Smartcard is extremely secure for Digital signatures or other activities, you may be wrong! The research done by Paul Rascagneres can remotely give access to victims smartcard! What makes the attack unique is it uses a keylogger to get the PIN or password and...

Nuked Klan SP CMS 4.5 - SQL Injection

Title: ====== Nuked Klan SP CMS v4.5 - SQL injection Vulnerability Date: ===== 2012-06-09 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=610 VL-ID: ===== 610 Common Vulnerability Scoring System: ==================================== 8 Introduction: =============...

SuSE 10 Security Update : eID-belgium (ZYPP Patch Number 6006)

eID-belgium uses EVPVerifyFinal incorrectly CVE-2009-0049 which allowed bypassing the validation of the certificate chain. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...

Fedora Update for opensc FEDORA-2010-19192

Check for the Version of opensc OpenVAS Vulnerability Test Fedora Update for opensc FEDORA-2010-19192 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Fedora Update for opensc FEDORA-2010-19193

Check for the Version of opensc OpenVAS Vulnerability Test Fedora Update for opensc FEDORA-2010-19193 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

[SECURITY] Fedora 14 Update: opensc-0.11.13-6.fc14

OpenSC is a package for for accessing smart card devices. Basic functionality e.g. SELECT FILE, READ BINARY should work on any ISO 7816-4 compatible smart card. Encryption and decryption using private keys on the smart card is possible with PKCS 15 compatible cards, such as the FINEID Finnish...

CVE-2010-0796

SQL injection vulnerability in the JE Quiz comjequizmanagement component 1.b01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the eid parameter in a question action to index.php...