2046 matches found
PT-2016-5193
Name of the Vulnerable Software and Affected Versions is-my-json-valid versions prior to 2.17.2 is-my-json-valid versions prior to 1.4.1 Description The issue is related to an incorrect regular expression in the is-my-json-valid package, which can cause a denial of service blocked event loop via ...
CVE-2016-2537: Improper Input Validation
The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports'utc-millisec' regular expression, which allows remote attackers to cause a denial of service blocked event loop via a crafted string...
PHP File Manager 'phpfm.php' Authentication Bypass Vulnerability
PHP File Manager is a suite of applications for managing web sites using PHP scripts. An authentication bypass vulnerability exists in PHP File Manager. An attacker can exploit this vulnerability to obtain a valid session and execute shell commands using restricted functionality...
Fedora Update for nodejs-is-my-json-valid FEDORA-2016-25
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 23 Update: nodejs-is-my-json-valid-2.12.4-1.fc23
A JSONSchema validator that uses code generation to be extremely fast...
PT-2016-3431 · Apache +5 · Apache Tomcat +5
Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 9.0.0.M1 through 9.0.0.M9 Apache Tomcat versions 8.5.0 through 8.5.4 Apache Tomcat versions 8.0.0.RC1 through 8.0.36 Apache Tomcat versions 7.0.0 through 7.0.70 Apache Tomcat versions 6.0.0 through 6.0.45 Description: T...
Regular Expression Denial of Service
Overview Versions of is-my-json-valid prior to 2.12.4 are affected by a regular expression denial of service vulnerability when user input is allowed into a utc-millisec validator. Recommendation Update to version 2.12.4 or later...
roundcubemail: remote code execution
High-Tech Bridge Security Research Lab discovered a path traversal vulnerability in Roundcube. Vulnerability can be exploited to gain access to sensitive information and under certain circumstances to execute arbitrary code and totally compromise the vulnerable server. The vulnerability exists du...
Design/Logic Flaw
The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before 3.0.4.0 allows remote attackers to reset arbitrary passwords via a crafted request with a valid username...
CVE-2015-8267
The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before 3.0.4.0 allows remote attackers to reset arbitrary passwords via a crafted request with a valid username...
HTTP GET Valid 'Referer' Request Header Detection
Binary data 9002.prm...
Code injection
The Secure Meeting Pulse Collaboration in Pulse Connect Secure formerly Juniper Junos Pulse before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 provides different messages for attempts to join a meeting depending on the status of the meeting, which allows remote attackers to enumerate...
Endian Firewall Proxy Password Change Command Injection
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Endian Firewall Proxy Password Change Command Injection', 'Description' = %q This module exploits an OS command injection...
CVE-2014-3612
The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier...
UBUNTU-CVE-2014-3612
The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier...
EMC Unified Infrastructure Manager/Provisioning Authentication Bypass Vulnerability
EMC Unified Infrastructure Manager is a manager built for converged infrastructures that automates the configuration, provisioning, viewing of topology, monitoring of events and availability. A security vulnerability exists in the use of LDAP authentication for EMC UIM configurations, which allow...
VK.com: Able to intercept app Traffic after choosing up the Secured Connection using SSL (HTTPS)
Install the app Login with Valid credentials Settings - Choose Secured connection HTTPS Close the app Set the proxy and Open the app verify that Connection isn't Secured and able to intercept PFA POC Expected Result : Secured layer & SSL PINING should be applied successfully...
CVE-2015-0532
EMC RSA Identity Management and Governance IMG 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account...
Oracle Database Server has a remote vulnerability (CNVD-2015-02520)
Oracle Database is a large database of commercial nature. A remote vulnerability exists in Oracle Database Server that allows an attacker to gain 'Valid account' privileges using the 'Oracle Net' protocol...