4445 matches found
CVE-2018-1791
IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an External Service Interaction attack, caused by improper validation of a request property. By submitting suitable payloads, an attacker could exploit this vulnerability to induce the Connections server to attack other systems. IBM X-Force ID:...
Apache Struts 2.0.x < 2.2.1 Security Bypass Vulnerability (S2-003)
The version of Apache Struts running on the remote host is 2.0.x prior to 2.2.1. It is, therefore, affected by a security bypass vulnerability in ParameterInterceptor due to improper validation of user-supplied input data. A remote, unauthenticated attacker can exploit this, to manipulate server...
CVE-2018-1000666
GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in method: notifySpaceModification; that can result in Improper validation ...
CVE-2018-1000666
GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in method: notifySpaceModification; that can result in Improper validation ...
Command injection
GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in method: notifySpaceModification; that can result in Improper validation ...
Multiple Apple Products WebKit Remote Code Execution Vulnerability (CNVD-2018-17669)
Apple iOS and others are products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser that comes with the Mac OS X and iOS operating systems. iCloud for Windows is a cloud service based on the Windows platform. WebKit is...
Input validation
An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 product all references, all versions prior to firmware V1.6.2.0. The vulnerability allows unauthorized users to remotely reboot Modicon M221 using crafted programing protocol frames...
Security Bulletin: IBM Security Access Manager Appliance is affected by Kerberos vulnerabilities (CVE-2017-11368, CVE-2017-7562)
Summary IBM Security Access Manager Appliance has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2017-11368 DESCRIPTION: MIT Kerberos 5 is vulnerable to a denial of service, caused by a KDC assertion failure. By sending a specially-crafted request, a remote authenticate...
Nextcloud Server 'JSON Encoder' Security Bypass Vulnerability
Nextcloud Server is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Improper validation of data passed to JSON encoder (NC-SA-2018-006)
Improper validation of input allowed an attacker to not have their actions logged to the audit log...
TripAdvisor Browsable Intent Arbitrary URL Loading Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on vulnerable installations of TripAdvisor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of browsab...
tlslite-ng off-by-one error on mac checking
tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line endpos = datalen - 1 - mac.digestsize that can...
GHSA-CWH5-3CW7-4286 tlslite-ng off-by-one error on mac checking
tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line endpos = datalen - 1 - mac.digestsize that can...
CVE-2018-5894
CVE-2018-5894 describes an out-of-bounds access caused by improper validation of an array index when parsing an mp4 in Snapdragon Automotive, Snapdragon Mobile, and Snapdragon Wear. The vulnerability affects multimedia parsing code, with exploitation possible via a crafted file over a network; ho...
Eclipse Jetty Server Fake Pipeline Request Security Bypass Vulnerability - Linux
Eclipse Jetty Server is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eclipse:jetty";...
CVE-2018-7787
In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTTP GET request...
PT-2018-18283
Name of the Vulnerable Software and Affected Versions: Schneider Electric U.motion Builder versions prior to 1.3.4 Description: The issue is caused by improper validation of input of the context parameter in an HTTP GET request. Recommendations: For versions prior to 1.3.4, update to version 1.3....
PT-2018-18175
Name of the Vulnerable Software and Affected Versions PAN-OS versions 8.0.0 through 8.0.10 Description A Cross-Site Scripting XSS issue exists in the PAN-OS URL filtering “continue page” due to improper validation of specific request parameters. This allows an attacker to inject arbitrary...
CVE-2018-0373
A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected system. The vulnerability is due to improper...