The Validator in TERASOLUNA Server Framework for Java(WEB) vulnerable to input validation bypass

Overview The TERASOLUNA Server Framework for JavaWEB provided by NTT Data Corporation is a software framework for creating web applications. The TERASOLUNA Server Framework for JavaWEB is vulnerable to an issue contained in the Apache Struts 1 Validator, since it uses Apache Struts 1.2.9. The...

SPCanywhere SSL Certificate Validation Security Restriction Bypass Vulnerability

SPCanywhere is the mobile app that allows remote access to Siemens SPC intruder alarm systems from your cell phone. SPCanywhere suffers from an SSL Certificate Validation Security Restriction Bypass vulnerability that stems from the application failing to properly validate an SSL certificate...

Ebay Magento Script Insertion

Document Title: =============== Ebay Inc Magento Bug Bounty 5 - Persistent Validation & Mail Encoding Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1226 eBay Inc. Bug Bounty Program ID: EIBBP-27288 Vulnerability Magazine:...

PHPB2B网站管理系统SQL注入漏洞(无视防注入)

简要描述： RT 详细说明： 注入链接：/virtual-office/job.php 注入参数：job 漏洞代码：（第52行开始） if !empty$POST'job' && $POST'save' $vals = $POST'job'; pbsubmitcheck'job'; // 验证post提交的token,可直接使用get访问job.php后在网页源码中搜索formhash获取 $nowjobamount = $job-findCountnull, "created".$todaystart." AND memberid=".$thememberid; if...

Prey Anti-Theft for Android missing SSL certificate validation [STIC-2014-0731]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Fundacion Dr. Manuel Sadosky - Programa STIC Advisory www.fundacionsadosky.org.ar Prey Anti-Theft for Android missing SSL certificate validation 1. Advisory Information Title: Prey Anti-Theft for Android missing SSL certificate validation Advisory ID:...

serf / Apache httpcomponents HttpClient / Jakarta Commons HttpClient SSL validation bypass

Invalid parsing of certificates with NUL character in CN...

CVE-2014-3394: Improper Certificate Validation

The Smart Call Home SCH implementation in Cisco ASA Software 8.2 before 8.25.50, 8.4 before 8.47.15, 8.6 before 8.61.14, 8.7 before 8.71.13, 9.0 before 9.04.8, and 9.1 before 9.15.1 allows remote attackers to bypass certificate validation via an arbitrary VeriSign certificate, aka Bug ID CSCun109...

PT-2014-5284 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco ASA Software versions 8.2 before 8.25.50 Cisco ASA Software versions 8.4 before 8.47.15 Cisco ASA Software versions 8.6 before 8.61.14 Cisco ASA Software versions 8.7 before 8.71.13 Cisco ASA Software versions 9.0 before 9.04.8 Cisco AS...

UBUNTU-CVE-2014-0489

APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package...

Apache HttpClient certificate checking bypass

Validation bypass via malcrafted constructions like O="foo,CN=www.apache.org”...

CVE-2014-3088

stconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format used in wAttach?OpenForm multipart/form-data POST requests, which allows remote authenticated users to bypass intended upload restrictions by modifying the Content-Type header and file extension, as...

Design/Logic Flaw

stconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format used in wAttach?OpenForm multipart/form-data POST requests, which allows remote authenticated users to bypass intended upload restrictions by modifying the Content-Type header and file extension, as...

deluxebb <= 1.3 - Multiple Vulnerabilities

No description provided by source. Author: cp77fk4r | Empty0pagEShift+2gmail.comhttp://gmail.com Vendor: http://www.deluxebb.com Directory Listing http://server/templates/ http://server/images/ http://server/logs/ http://server/wysiwyg/ http://server/docs/ http://server/classes http://server/lang...

CVE-2014-2003

CVE-2014-2003 affects JustSystems products that bundle the JUST Online Update (e.g., Ichitaro) up through 2014. The issue is a flaw in how update-module signatures are validated, allowing a remote attacker to spoof modules and execute arbitrary code via a crafted signature. Root cause: insufficie...

PT-2014-3206

Name of the Vulnerable Software and Affected Versions OpenText Exceed OnDemand EoD version 8 Description The issue allows man-in-the-middle attackers to bypass server certificate validation, redirect a connection, and obtain sensitive information via crafted responses, due to the client supportin...

CVE-2013-6807: Undefined Security Weakness

The client in OpenText Exceed OnDemand EoD 8 supports anonymous ciphers by default, which allows man-in-the-middle attackers to bypass server certificate validation, redirect a connection, and obtain sensitive information via crafted responses...

PT-2014-3488

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.3.11 Moodle versions 2.4.x before 2.4.9 Moodle versions 2.5.x before 2.5.5 Moodle versions 2.6.x before 2.6.2 Description The issue concerns the time-validation implementation in certain Moodle files, allowing remote...

多个ASUS路由器跨站脚本和验证绕过漏洞

No description provided by source...

Mozilla Thunderbird vulnerability allows hackers to Insert malicious code into Emails

Do you use Thunderbird, a free; open-source; cross-platform application for managing email and news feeds? According to a Pakistani Security Researcher from Vulnerability-Lab, a flaw gives an attacker the ability to run code on a user’s machine. Mozilla Thunderbird 17.0.6 email application is...

Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass

Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass Document Title: =============== Mozilla Bug Bounty 5 - WireTap Remote Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=953 Mozilla Bug Tracking ID: 875818 Video:...