GHSA-84FV-PRRC-5GGR Route Validation Bypass in call

Affected versions of call do not validate empty parameters, which may result in a bypass of route validation rules. Proof of Concept Routing Scheme: /api/param/param2/details Triggering Request Path: /api/// Recommendation Update to version 3.0.2 or later...

[SECURITY] [DLA 1650-1] rssh security update

Package : rssh Version : 2.3.4-4+deb8u1 CVE ID : CVE-2019-1000018 Debian Bug : 919623 The ESnet security team discovered a vulnerability in rssh, a restricted shell that allows users to perform only scp, sftp, cvs, svnserve Subversion, rdist and/or rsync operations. Missing validation in the scp...

Input validation

An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation...

Foxit PhantomPDF < 8.3.9 Multiple Vulnerabilities

According to its version, the Foxit PhantomPDF application formally known as Phantom installed on the remote Windows host is prior to 8.3.9. It is, therefore, affected by following vulnerabilities: - An out-of-bounds read/write vulnerability exists when handling certain XFA element attributes. Th...

Validation Bypass

neutron is vulnerable to an IP address validation bypass. Non-privileged tenants are able to create and attach ports without specifying an IP address, which could lead to a denial of service condition when an assigned IP address conflict occurs with existing guests or routers...

Validation Bypass

ntp is vulnerable to validation bypass. It was discovered that ntpd as a client did not correctly check the originate timestamp in received packets. A remote attacker could use this flaw to send a crafted packet to an ntpd client that would effectively disable synchronization with the server, or...

KLA11398 Multiple vulnerabilities in Foxit Reader and Foxit PhantomPDF

Multiple vulnerabilities were found in Foxit Reader and Foxit PhantomPDF. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Out-of-bounds Write/Read vulnerability can be exploited remotely to...

Foxit Reader < 9.4 Multiple Vulnerabilities

The version of Foxit Reader installed on the remote Windows host is prior to 9.4. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds read/write vulnerability and crash when handling XFA element attributes. CVE-2018-3956 - A signature validation bypass vulnerability which...

Foxit PhantomPDF < 9.4 Multiple Vulnerabilities

According to its version, the Foxit PhantomPDF application formally known as Phantom installed on the remote Windows host is prior to 9.4. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds read/write vulnerability and crash when handling XFA element attributes...

PT-2019-3599 · Apache +1 · Apache Thrift Java Client Library +1

Name of the Vulnerable Software and Affected Versions: Apache Thrift Java client library versions 0.5.0 through 0.11.0 Description: The issue is related to insufficient input validation in the org.apache.thrift.transport.TSaslTransport class, allowing a remote attacker to bypass SASL negotiation...

Foxit Reader and PhantomPDF for Windows Validation Bypass Vulnerability

Foxit Reader for Windows is China's Foxit Foxit software company's a Windows-based platform for PDF document reader. PhantomPDF for Windows is its commercial version. A validation bypass vulnerability exists in Foxit Reader 9.3.0.10826 and earlier versions and PhantomPDF 9.3.0.10826 and earlier...

Authorization Bypass During JWT Issuer Validation with spring-security

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWT...

CVE-2018-9084

In System Management Module SMM versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented...

CVE-2018-9084

In System Management Module SMM versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented...

Validation Bypass

Apache Struts is vulnerable to validation bypass. Applications that do not use isCancelled check do not detect a cancelled action which allows remote attackers to bypass validation via a request with a org.apache.struts.taglib.html.Constants.CANCEL parameter...

Cisco Stealthwatch Management Console Backup Authentication Bypass Vulnerability

Cisco Stealthwatch Management Console is a data collection and analysis device from cisco. Cisco Stealthwatch Management Console has a share validation bypass vulnerability that is caused by an insecure system configuration. An attacker can exploit this vulnerability by sending a crafted HTTP...

Updated lilypond packages fix security vulnerability

lilypond does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks CVE-2017-17523...

CVE-2018-15387 Cisco SD-WAN Solution Certificate Validation Bypass Vulnerability

A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. The vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by supplying a system image signed with a...

CVE-2018-15387 Cisco SD-WAN Solution Certificate Validation Bypass Vulnerability

A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. The vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by supplying a system image signed with a...

Duplicate Advisory: Moderate severity vulnerability that affects activemodel

Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-543v-gj2c-r3ch. This link is maintained to preserve external references. Original Description Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the...