express-restify-mongoose information disclosure vulnerability

express-restify-mongoose is a tool for creating interfaces for Mongoose Model. A security vulnerability exists in express-restify-mongoose version 2.4.2 and earlier and versions 3.0.X through 3.0.1. An attacker can exploit the vulnerability by sending a request to obtain the passwords of all user...

CVE-2016-10539

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...

DEBIAN-CVE-2016-10539

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...

CVE-2016-10539

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...

CVE-2016-10533

express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for GET /User?distinct=password and get all the passwords for all the users in the...

CVE-2016-10539

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...

UBUNTU-CVE-2016-10539

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...

Design/Logic Flaw

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...

CVE-2016-10539

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...

CVE-2016-10533

CVE-2016-10533 affects express-restify-mongoose. Vulnerable versions (2.4.2 and earlier, and 3.0.X through 3.0.1) allow a malicious user to abuse GET /User?distinct=password to retrieve all user passwords, bypassing private field protections. The root cause is information leakage through listing/...

CVE-2016-10539

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...

CVE-2018-0277

A vulnerability in the Extensible Authentication Protocol-Transport Layer Security EAP-TLS certificate validation during EAP authentication for the Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause the ISE application server to restart unexpectedly, causi...

commenting.indianexpress.com XSS vulnerability

Open Bug Bounty ID: OBB-614056 Description| Value ---|--- Affected Website:| commenting.indianexpress.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

commenting.financialexpress.com XSS vulnerability

Open Bug Bounty ID: OBB-614054 Description| Value ---|--- Affected Website:| commenting.financialexpress.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

Threat Outbreak Alert RuleID32688: Email Messages Distributing Malicious Software on May 4, 2018

Medium Alert ID: 57805 First Published: 2018 May 4 15:13 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32688 may contain the following files: Name | Size ...

Cisco Aironet suffers from a power lift vulnerability

The Cisco Aironet 1800, 2800, and 3800 Series Access Points are different families of wireless access point devices from Cisco, Inc.Mobility Express Software is a set of management and control software that runs on them. An extraction vulnerability exists in the management and assignment of defau...

Cisco Aironet suffers from a denial of service vulnerability (CNVD-2018-08990)

The Cisco Aironet 1810, 1830, and 1850 Series Access Points are different families of wireless access point devices from Cisco, Inc.Mobility Express Software is a set of management and control software that runs on them. The Mobility Express Software versions 8.4.100.0, 8.5.103.0, and 8.5.105.0 o...

CVE-2018-0235

A vulnerability in the 802.11 frame validation functionality of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. The vulnerability is due to incomplete input...

CVE-2018-0226

A vulnerability in the assignment and management of default user accounts for Secure Shell SSH access to Cisco Aironet 1800, 2800, and 3800 Series Access Points that are running Cisco Mobility Express Software could allow an authenticated, remote attacker to gain elevated privileges on an affecte...

CVE-2018-0234

A vulnerability in the implementation of Point-to-Point Tunneling Protocol PPTP functionality in Cisco Aironet 1810, 1830, and 1850 Series Access Points could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service DoS condition. The...