krb5: Authentication bypass by improper validation of certificate EKU and SAN

An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances...

CVE-2018-1000154

Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page CWE-80 vulnerability in the subject of emails which are not html quoted in certain cases. This can result in the embedding and execution of java script code on users browser...

OpenJDK: use of global credentials for HTTP/SPNEGO (JGSS, 8186600)

The JGSS component of OpenJDK ignores the value of the javax.security.auth.useSubjectCredsOnly property when using HTTP/SPNEGO authentication and always uses global credentials. It was discovered that this could cause global credentials to be unexpectedly used by an untrusted Java application...

Unauthorized Message Through Race Conditions

geode-core is vulnerable to unauthorized messages through race conditions. The vulnerability exists as a message can be authorized before actually receiving its security subject...

OpenJDK: use of global credentials for HTTP/SPNEGO (JGSS, 8186600)

The JGSS component of OpenJDK ignores the value of the javax.security.auth.useSubjectCredsOnly property when using HTTP/SPNEGO authentication and always uses global credentials. It was discovered that this could cause global credentials to be unexpectedly used by an untrusted Java application...

VulnCheck KEV: CVE-2017-14321

Multiple cross-site scripting XSS vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 customer name or 2 subject in a ticket...

The vulnerability of the MatrixSSL cryptographic information protection software lies in buffer overflows in dynamic memory, allowing attackers to execute arbitrary code.

The vulnerability of the MatrixSSL information encryption software arises from an overflow in the buffer in the dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a X.509 certificate with a specially crafted “Subject Alt Name”...

DSMmall Multi-merchant open source mall system get_subject_by_typeid method SQL injection vulnerability

DSMmall multi-commercial open source mall source code is a thinkPHP as the framework for the development of multi-user mall system source code. DSMmall multi merchant open source mall system getsubjectbytypeid method SQL injection vulnerability. The vulnerability is due to the system fails to...

EPESI 1.8.2 rev20170830 - Cross-Site Scripting

EPESI 1.8.2 rev20170830 - Cross-Site Scripting Exploit Title: Multiple Stored XSS in EPESI Date: 10/03/2017 Exploit Author: Zeeshan Shaikh Vendor Homepage: http://epe.si/ Software Link: http://epe.si/download/ Version: 1.8.2 rev20170830 CVE : CVE-2017-14712 to CVE-2017-14717 Category: webapps XSS...

Telaxus EPESI cross-site scripting vulnerability (CNVD-2017-32708)

Telaxus EPESI is a Polish company Telaxus open source customer relationship management system based on PHP/Ajax framework CRM. The system provides schedule management , multi-user address book , proxy matters and other functions . A cross-site scripting vulnerability exists in the 'Phonecalls...

Cross site scripting

In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Subject parameter...

CVE-2017-14714

In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Subject parameter...

CVE-2017-14714

EPESI 1.8.2 rev20170830 is vulnerable to a stored cross-site scripting (XSS) flaw in the Phonecalls Subject field. The issue is documented across multiple sources (including CVE-2017-14714 entries and related advisories) as a stored XSS in the Phonecalls Subject parameter. The available connected...

CVE-2017-14321

Multiple cross-site scripting XSS vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 customer name or 2 subject in a ticket...

CVE-2017-14321

Multiple cross-site scripting XSS vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 customer name or 2 subject in a ticket...

CVE-2015-0210

wpasupplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack...

CVE-2015-0210

wpasupplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack...

CVE-2015-0210

CVE-2015-0210 affects wpa_supplicant 2.0-16 and involves improper validation of the server certificate subject name, enabling remote MITM risk. Multiple connected sources (SUSE SUSE-SU-2018:1659-1, CNVD/CVEs, NVD entry) corroborate a vulnerability in wpa_supplicant 2.0-16 and describe the issue a...

CVE-2017-9801

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers...

Rspamd Cross-Site Scripting Vulnerability

Rspamd is a fast spam filtering system. The system evaluates and filters spam through regular expressions, statistical analysis and blacklists. A cross-site scripting vulnerability exists in the interface/js/app/history.js file of the WebUI in versions of Rspamd prior to 1.6.3. A remote attacker...