Paragon Initiative Enterprises: Improper validation of Email

1.goto https://bridge.cspr.ng/my/account here no rate limit present for email and display name,real name i just entered 1000 character length email in email field and it accepted also for the display name ,real name another there is no regular expression to check valid email if u give email as...

Heap overflow

Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Out of Bounds Write on a Heap Buffer due to improper validation of dwCompressionSize of Microsoft WIM Header WIMHEADERV1PACKED. This vulnerability can be...

NVIDIA Linux GPU Display Driver contains missing permissions check and improper validation vulnerabilities - us

Lenovo Security Advisory: LEN-10962 Potential Impact: Privilege escalation Severity: Medium Scope of Impact: Industry-Wide CVE Identifier: CVE-2016-7382, CVE-2016-7389 Summary Description: The NVIDIA GPU Display Driver for Linux contains two privilege escalation vulnerabilities. CVE-2016-7382...

Weblate: [hosted.weblate.org]Account Takeover

Hello Team, Steps to Reproduce: Go to Login Page Reset Your Password by Clicking Reset it. Put your email and answer the captcha. Go to your email and click your reset Link. You dont need to Change Your Password because you'll be logged in. Scenario Victim forgot to logout his/her Email Account o...

pcs Cross-Site Request Forgery Vulnerability

PCS is a set of tools for configuring and managing Pacemaker and Corosync clustering software using the command line and web UI. A cross-site request forgery vulnerability exists in pc, which can be exploited by remote attackers to perform certain unauthorized actions and access affected...

Cross-Site Scripting in PAN-OS

A vulnerability exists in the PAN-OS GlobalProtect external interface that could allow for a cross-site scripting XSS attack. PAN-OS does not properly validate specific request parameters. Ref PAN-70674 / CVE-2017-7409 Successful exploitation of this issue may allow an attacker to inject arbitrar...

Palo Alto Networks PAN-OS 7.0.x < 7.0.14 / 7.1.x < 7.1.9 Multiple Vulnerabilities (PAN-SA-2017-0008 - PAN-SA-2017-0010)

The version of Palo Alto Networks PAN-OS running on the remote host is 7.0.x prior to 7.0.14 or 7.1.x prior to 7.1.9. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the Management Web Interface due to improper validation of certain request parameters. An authenticated...

CVE-2017-1161

IBM API Connect 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Portal. By crafting a malicious URL, an attacker could exploit this vulnerability to execute arbitrary commands on the system with the...

Input validation

Palo Alto Networks Traps ESM Console before 3.4.4 allows attackers to cause a denial of service by leveraging improper validation of requests to revoke a Traps agent license...

CVE-2017-7408

The CVE-2017-7408 entry affects Palo Alto Networks Traps ESM Console up to version 3.4.3 (before 3.4.4). The issue is a denial-of-service condition caused by improper validation when processing requests to revoke a Traps agent license. In affected deployments, an attacker could trigger the DoS by...

CVE-2017-7228: Improper Validation of Array Index

An issue known as XSA-212 was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arra...

Mozilla Firefox < 52.0.1 CreateImageBitmap RCE (macOS)

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 52.0.1. It is, therefore, affected by an integer overflow condition in the nsGlobalWindow::CreateImageBitmap function within file dom/base/nsGlobalWindow.cpp due to improper validation of certain input. An...

Kodi Local File Inclusion Information Disclosure

The Kodi media player server running on the remote host is affected by an information disclosure vulnerability in the Chorus web interface due to improper validation of user-supplied input to the /image/ script, specifically when path traversal is employed e.g., %2F in the URL. An unauthenticated...

Security Advisory - Sixteen OpenSSL Vulnerabilities on Some Huawei products

Statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service use-after-free or possibly execute arbitrary code via a crafted TLS session. Vulnerability ID: HWPSIRT-2016-09065 This vulnerability has been...

Fatek Automation PLC WinProladder Stack Buffer Overflow (CVE-2016-8377)

A stack-based buffer overflow exists in Fatek Automation PLC WinProladder. The vulnerability is due to improper validation of user supplied data before copying to a stack-based buffer. A remote attacker could exploit this vulnerability by sending a crafted pdw file over a network to the vulnerabl...

CVE-2016-3020

IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 could allow a remote attacker to bypass security restrictions, caused by improper content validation. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to bypass validation and load a...

CVE-2016-0217: Improper Neutralization of Input During Web Page Generation

IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web...

ImageMagick 6.x < 6.9.7-3 ReadPSDLayers() Function PSB File Handling RCE

The version of ImageMagick installed on the remote Windows host is 6.x prior to 6.9.7-3. It is, therefore, affected by a remote code execution vulnerability in the ReadPSDLayers function in psd.c due to improper validation of PSB files. An unauthenticated, remote attacker can exploit this, by...

Open-Xchange (OX) App Suite Multiple Vulnerabilities -02 (Jan 2017)

Open-Xchange OX App Suite is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cisco ASA Web Interface Remote XML Command Injection (cisco-sa-20161116-asa)

According to its self-reported version and configuration, the Cisco Adaptive Security Appliance ASA software running on the remote device is affected by an XML command injection vulnerability in the web-based management interface due to improper validation of user-supplied input. An...