libpam4j: Account check bypass

It was found that libpam4j did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information...

libpam4j: Account check bypass

It was found that libpam4j did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information...

WolfSSL CyaSSL Certificate Validation Bypass Vulnerability

WolfSSL CyaSSL is the United States WolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A certificate validation bypass vulnerability exists in WolfSSL CyaSSL. A remote attacker can exploit this vulnerability to spoof a server with a speciall...

CVE-2017-1002153

Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission...

codeigniter -- input validation bypass

The CodeIgniter changelog reports: Security: Fixed a potential object injection in Cache Library 'apc' driver when save is used with $raw = TRUE...

RubyGems: Unpacker improperly validates symlinks, allowing gems writes to arbitrary locations

Unpacker improperly validates symlinks, allowing gems writes to arbitrary locations The RubyGems installer attempts to prevent a gem from writing any files outside the install directory; however it is possible to bypass the check with a symbolic link in a crafted gem. Example structure of malicio...

WordPress 2.3.0-4.7.4 - Authenticated SQL injection

Description Due bad solution of the database abstraction library WordPress exposes itself towards SQL Injection and validation bypass. Beside WordPress itself this issue have huge impact towards complete WP ecosystem. Up to WordPress 4.8.1 is vulnerable, but this time attack is dependent from...

Randombit Botan Library X509 Certificate Validation Bypass Vulnerability(CVE-2017-2801)

Summary A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in...

Unauthorized Operation Vulnerability in Digital Orientation Management System of New Cape Electronics Co.

Digital Orientation Management System is a student system solution. An unauthorized operation vulnerability exists in the Digital Orientation Management System DOMS of Xin Kaipu Electronics Co. The vulnerability is caused by the failure to validate the background parameters of the website, which...

Execution Of Arbitrary Authentication Source

SimpleSAMLphp is vulnerable to execution of arbitrary authentication source. This can happen because it does not validate the user input for choice of authentication source against a list of valid sources set by the administrator in multiauth module...

Orpheus' Lyre mutual authentication validation bypass

All versions of Samba from 4.0.0 include an embedded copy of Heimdal Kerberos. Heimdal has made a security release, which disclosed: Fix CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation This is a critical vulnerability. In krb5extractticket the KDC-REP service name must be obtained...

Google Chrome Security Bypass Vulnerability (CNVD-2017-09205)

Google Chrome is a web browser developed by the American company Google Google. A security bypass vulnerability exists in versions of Google Chrome prior to 59.0.3071.86. An attacker can exploit the vulnerability to bypass extension validation...

CVE-2017-8943

The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Gratipay: Unauthorized access to the slack channel via inside.gratipay.com/appendices/chat

Summary It is possible to force send invites for gratipay slack channel to arbitary email ids with no bruteforce limit. This is done by modifying the coc parameter to 1 in the POST data sent from https://inside.gratipay.com/appendices/chat Description Sending a post request with coc parameter set...

Code injection

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...

CVE-2017-2989

Adobe Campaign versions Build 8770 and earlier have an input validation bypass that could be exploited to read, write, or delete data from the Campaign database...

CVE-2017-2989

Adobe Campaign versions Build 8770 and earlier have an input validation bypass that could be exploited to read, write, or delete data from the Campaign database...

APSB17-09 Security update available for Adobe Campaign

Adobe has released a security update for Adobe Campaign v6.11 for Windows and Linux. This update resolves an important input validation bypass that could be exploited to read, write or delete data from the Campaign database CVE-2017-2989...

CVE-2017-3902

Cross-site scripting XSS vulnerability in the Web user interface UI in Intel Security ePO 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows authenticated users to inject malicious Java scripts via bypassing input validation...

CVE-2017-3902

Cross-site scripting XSS vulnerability in the Web user interface UI in Intel Security ePO 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows authenticated users to inject malicious Java scripts via bypassing input validation...