Updated bouncycastle packages fix security vulnerabilities

Updated bouncycastle packages fix security vulnerabilities: Ensure full validation of ASN.1 encoding of signature on verification. It was possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may have allowed the introduction of...

PoDoFo Information Disclosure Vulnerability

PoDoFo is an open source , written in C++ using the PDF file format library . PoDoFo in the 'PdfEncoding::ParseToUnicode ' function there is an information leakage vulnerability , the vulnerability stems from the program fails to correctly validate the data submitted by the user , an attacker can...

Hacking AIS

Maritime AIS, or ‘Automatic Identification System’ is used for broadcast and reception of vessel position and information alerts. It has proved invaluable since its introduction in the 1990s and has undoubtedly helped prevent many marine accidents, collisions and related incidents. Previous...

PHP Apache2 Component Cross-Site Scripting Vulnerability

PHP is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. The language is primarily used for web development and supports a variety of databases and operating systems.Apache2 is one of the HTTP server components. A cross-site...

CyberChef - The Cyber Swiss Army Knife [A Web App For Encryption, Encoding, Compression And Data Analysis]

The Cyber Swiss Army Knife CyberChef is a simple, intuitive web app for carrying out all manner of "cyber" operations within a web browser. These operations include simple encoding like XOR or Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps, compression an...

Design/Logic Flaw

The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the phphandler function in sapi/apache2handler/sapiapache2.c...

CVE-2018-17082

The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the phphandler function in sapi/apache2handler/sapiapache2.c...

CVE-2018-17082

The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the phphandler function in sapi/apache2handler/sapiapache2.c...

CVE-2018-17082

Removed by vendor...

PHP 7.1.x < 7.1.22 Transfer-Encoding Parameter XSS Vulnerability

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.22. It is, therefore, affected by a cross-site scripting vulnerability. An attacker could leverage this vulnerability to inject malicious code which executes within the security context of the...

Bayanno Hospital Management System 4.0 Cross Site Scripting

Exploit Title: Bayanno Hospital Management System 4.0 - Cross-Site Scripting Date: 2018-09-05 Software Link: https://codecanyon.net/item/bayanno-hospital-management-system/5814621 Exploit Author: Gokhan Sagoglu Vendor Homepage:: http://creativeitem.com/ Version: v4.0 Live Demo:...

U.S. Dept Of Defense: Cross Site Scripting (XSS) – Reflected

Reflected Cross-site Scripting XSS occur when an attacker injects browser executable code within a single HTTP response.When a web application is vulnerable to this type of attack, it will pass unvalidated input sent through requests back to the client. The value of request parameter is copied in...

CVE-2018-2464

SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting XSS vulnerability...

CVE-2018-2452

The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting XSS vulnerability...

bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of...

Bayanno Hospital Management System 4.0 - Cross-Site Scripting

Exploit Title: Bayanno Hospital Management System 4.0 - Cross-Site Scripting Date: 2018-09-05 Software Link: https://codecanyon.net/item/bayanno-hospital-management-system/5814621 Exploit Author: Gokhan Sagoglu Vendor Homepage:: http://creativeitem.com/ Version: v4.0 Live Demo:...

The vulnerability of the encryption module for internal data in Philips e-Alert Unit software solutions allows a intruder to gain full access to the device’s data.

The vulnerability of the encryption module for internal data in Philips e-Alert Unit medical visualization systems arises from the rigid encoding of the cryptographic key used for encrypting internal data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full...

Cross-Site Scripting (XSS)

rack-mini-profiler is vulnerable to cross-site scripting. The user info displayed in Error 404 pages is not HTML encoded which could potentially allow an attacker to inject arbitrary Javascript code into a victim's browser...

August 30, 2018—KB4343891 (Preview of Monthly Rollup)

None None...

SAP Business Objects Financial Consolidation Cross-Site Scripting Vulnerability (CNVD-2018-17911)

SAP Business Objects is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The program provides reporting, performance management, and data base functions. financial Consolidation is one of the tools used to connect financial systems. A cross-site...