CVE-2017-11424

In PyJWT 1.5.0 and below the invalidstrings check in HMACAlgorithm.preparekey does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string -----BEGIN RSA PUBLIC KEY----- which is not accounted for. This enable...

CentOS 7 : libtasn1 (CESA-2017:1860)

An update for libtasn1 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2017-11424

In PyJWT 1.5.0 and below the invalidstrings check in HMACAlgorithm.preparekey does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string -----BEGIN RSA PUBLIC KEY----- which is not accounted for. This enable...

CVE-2017-11424

In PyJWT 1.5.0 and below the invalidstrings check in HMACAlgorithm.preparekey does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string -----BEGIN RSA PUBLIC KEY----- which is not accounted for. This enable...

CVE-2017-11424

In PyJWT 1.5.0 and below the invalidstrings check in HMACAlgorithm.preparekey does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string -----BEGIN RSA PUBLIC KEY----- which is not accounted for. This enable...

Security: Improper handling of path parameters allows bypassing the security constraint

It was found that Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded / to a request an attacker may be able to bypass a security constraint...

Поиск работы на HeadHunter. Вакансии рядом с домом - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Поиск работы на HeadHunter. Вакансии рядом с домом published at the 'play' market has multiple vulnerabilities...

CVE-2017-7642

The sudo helper in the HashiCorp Vagrant VMware Fusion plugin aka vagrant-vmware-fusion before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable...

CVE-2017-7642

The sudo helper in the HashiCorp Vagrant VMware Fusion plugin aka vagrant-vmware-fusion before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable...

Last Day on Earth: Survival - Base64 encoded String, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Last Day on Earth: Survival published at the 'play' market has multiple vulnerabilities...

Security Master - Antivirus, VPN, AppLock, Booster - Base64 encoded String, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Security Master - Antivirus, VPN, AppLock, Booster published at the 'play' market has multiple vulnerabilities...

Vivalines Turizm - Base64 encoded String, Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Vivalines Turizm published at the 'play' market has multiple vulnerabilities...

LINE Bubble! - Base64 encoded String, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application LINE Bubble! published at the 'play' market has multiple vulnerabilities...

Be-be-bears - Creative world - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Be-be-bears - Creative world published at the 'play' market has multiple vulnerabilities...

Бородач. День рождения Иришки - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Бородач. День рождения Иришки published at the 'play' market has multiple vulnerabilities...

TextNow - free text + calls - Base64 encoded String, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application TextNow - free text + calls published at the 'play' market has multiple vulnerabilities...

WhatsApp Messenger - Base64 encoded String, Customized SSL vulnerabilities

HackApp vulnerability scanner discovered that application WhatsApp Messenger published at the 'play' market has multiple vulnerabilities...

XnView Classic for Windows Buffer Overflow Vulnerability (CNVD-2017-19917)

XnView Classic for Windows is an image viewing software for Windows developed by French software developer Gougelet Pierre-Emmanuel. The software can be used to view, convert, organize and edit graphic and video files. A buffer overflow vulnerability exists in version 2.40 of XnView Classic for...

XnView Classic for Windows Buffer Overflow Vulnerability (CNVD-2017-19920)

XnView Classic for Windows is an image viewing software for Windows developed by French software developer Gougelet Pierre-Emmanuel. The software can be used to view, convert, organize and edit graphic and video files. A buffer overflow vulnerability exists in version 2.40 of XnView Classic for...

XnView Classic for Windows Buffer Overflow Vulnerability (CNVD-2017-14503)

XnView Classic for Windows is an image viewing software for Windows developed by French software developer Gougelet Pierre-Emmanuel. The software can be used to view, convert, organize and edit graphic and video files. A buffer overflow vulnerability exists in version 2.40 of XnView Classic for...