D-Link DIR-850L REV.A and REV.B Man-in-the-Middle Attack Vulnerability

The D-Link DIR-850L REV.A and REV.B are both wireless router products from AUO D-Link. The security vulnerability in the D-Link NPAPI extension used in D-Link DIR-850L REV.A devices with firmware FW114WWb07h2abbeta1 and earlier and REV.B devices with firmware FW208WWb02 and earlier stems from the...

BlackCat CMS File Upload Vulnerability

BlackCat CMS is a content management system CMS based on PHP5 and HTML5 developed by Black Cat team. A security vulnerability exists in BlackCat CMS version 1.2.2, which stems from the program's failure to validate file extensions. The vulnerability can be exploited to upload files with extension...

PT-2017-2916

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 through 4.7 Description A remote code execution issue exists due to insufficient input validation in the IsValidUrl method of the SOAP WSDL Parser module. This allows an attacker to execute arbitrary code...

Cisco ASR 5500 System Architecture Evolution Gateway Denial of Service Vulnerability

Cisco ASR 5500 System Architecture Evolution SAE Gateways is a gateway device from Cisco.General Packet Radio Service GPRS Tunneling Protocol ingress packet handler is one of the General Packet Radio Service GPRS Tunneling Protocol ingress packet handlers. A denial of service vulnerability exists...

FFmpeg 'mxf_read_primer_pack' function input validation vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A security vulnerability exists in the 'mxfreadprimerpack' function in the libavformat/mxfdec.c file in FFmpeg version 3.3.3. A remote attacker can exploit this vulnerability to bypass...

CVE-2017-12212

A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain...

ungo DriverWizard WinDriver Overflow Vulnerability

Jungo WinDriver is a PCI/USB device driver development tool from Jungo Connectivity, Israel. A security vulnerability exists in Jungo WinDriver 12.4.0 and earlier versions, which originates from the program failing to properly validate user-submitted data. A local attacker can exploit the...

DEBIAN-CVE-2017-12869

The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input...

CVE-2017-12869

The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input...

The vulnerability of the Android CAF-release operating system, which stems from insufficient validation of input data, allows attackers to bypass proper validation of system calls to mink.

The vulnerability of the Android CAF-release operating system exists due to insufficient checking of input data. Exploiting this vulnerability allows a remote attacker to improperly validate system calls to mink...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation. In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service Segmentation Fault, as demonstrated by an invalid ISALNUM argument. Remediation There is no fixed version fo...

DEBIAN-CVE-2017-10663

The sanitycheckckpt function in fs/f2fs/super.c in the Linux kernel before 4.12.4 does not validate the blkoff and segno arrays, which allows local users to gain privileges via unspecified vectors...

IBM WebSphere Application Server 7.0.0.x < 7.0.0.43 / 8.0.0.x < 8.0.0.14 / 8.5.x < 8.5.5.12 / 9.0.0.x < 9.0.0.4 SOAP Connectors DoS

The IBM WebSphere Application Server running on the remote host is version 7.0.0.x prior to 7.0.0.43, 8.0.0.x prior to 8.0.0.14, 8.5.x prior to 8.5.5.12, or 9.0.0.x prior to 9.0.0.4. It is, therefore, affected by an input validation flaw in SOAP connectors that allows a remote user to cause...

Multiple Lenovo Products BIOS SMI Handler Bypass System Protection Vulnerability

The Lenovo IdeaCentre 300-20ISH and others are products of Lenovo, a Chinese company.The Lenovo IdeaCentre 300-20ISH is a desktop computer; the ThinkServer RD540 is a server device.The BIOS SMI Handler is one of the management Information Architecture Handler program. A security vulnerability...

CVE-2017-10949

Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly validate user provided path before using it in file operations. Was ZDI-CAN-4459...

Huawei Mobile Product Input Validation Vulnerability

The Huawei Vicky-AL00A/Victoria-AL00A/Warsaw-AL00 is a smartphone from the Chinese company Huawei Huawei. An input validation vulnerability exists in the Bastet of the Huawei Vicky-AL00A/Victoria-AL00A/Warsaw-AL00 phones due to a lack of parameter checking. An attacker can trick the user into...

CVE-2017-11385

SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input validation in cmdHandlerStatusMonitor.dll. Formerly ZDI-CAN-4545...

python: failure to validate certificates in the HTTP client with TLS (PEP 476)

The Python standard library HTTP client modules such as httplib or urllib did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data...

gnutls: Incorrect certificate validation when using OCSP responses (GNUTLS-SA-2016-3)

A flaw was found in the way GnuTLS validated certificates using OCSP responses. This could falsely report a certificate as valid under certain circumstances...

CVE-2017-11670

A length validation leading to out-of-bounds read and write flaw was found in the way eapmd5pass 1.4 handled network traffic in the extracteapusername function. A remote attacker could potentially use this flaw to crash the eapmd5pass process by generating specially crafted network traffic...