Zend Framework < 2.2.9 / 2.3.x < 2.3.4 Session Validators Security Bypass

Binary data 9141.prm...

GLSA-201510-06 : Django: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201510-06 Django: Multiple vulnerabilities Multiple vulnerabilities have been found in Django: Session backends create a new record anytime request.session was accessed CVE-2015-5143 Built-in validators in Django do not properly...

Fedora 21 : php-ZendFramework2-2.4.8-1.fc21 (2015-16032)

Zend Framework 2.4.8 Security Update ZF2015-07: The filesystem storage adapter of Zend\Cache was creating directories with a liberal umask that could lead to local arbitrary code execution and/or local privilege escalation. This release contains a patch that ensures the directories are created...

Debian DLA-272-1 : python-django security update

Several vulnerabilities were discovered in Django, a high-level Python web development framework : CVE-2015-2317 Daniel Chatfield discovered that python-django, a high-level Python web development framework, incorrectly handled user-supplied redirect URLs. A remote attacker could use this flaw to...

[SECURITY] [DLA 272-1] python-django security update

Package : python-django Version : 1.2.3-3+squeeze13 CVE ID : CVE-2015-2317 CVE-2015-5143 CVE-2015-5144 Several vulnerabilities were discovered in Django, a high-level Python web development framework: CVE-2015-2317 Daniel Chatfield discovered that python-django, a high-level Python web developmen...

Header injection via multi-lines input

Some built-in validators django.core.validators.EmailValidator, most seriously don't prohibit newline characters due to the usage of $ instead of \Z in the regular expressions. If you use values with newlines in HTTP response or email headers, you can suffer from header injection attacks...

Debian DSA-3305-1 : python-django - security update

Several vulnerabilities were discovered in Django, a high-level Python web development framework : - CVE-2015-5143 Eric Peterson and Lin Hua Cheng discovered that a new empty record used to be created in the session storage every time a session was accessed and an unknown session key was provided...

Important: Red Hat Security Advisory: openstack-packstack and openstack-puppet-modules security and bug fix update

Updated openstack-packstack and openstack-puppet-modules packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux OpenStack Platform 6.0. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring...

Zend Framework Session Validators Security Bypass Vulnerability

Zend Framework ZF is an open source PHP5 development framework for developing web programs and services. A session authenticator security restriction bypass vulnerability exists in the implementation of Zend Framework, which can be exploited by an attacker to bypass certain security restrictions...

Fedora 21 : php-symfony-2.5.4-1.fc21 (2014-10239)

2.5.4 2014-09-03 - security 11832 CVE-2014-6072 fabpot - security 11831 CVE-2014-5245 stof - security 11830 CVE-2014-4931 aitboudad, Jeremy Derusse - security 11829 CVE-2014-6061 damz, fabpot - security 11828 CVE-2014-5244 nicolas-grekas, larowlan - bug 10197 FrameworkBundle PhpExtractor bugfix a...

[SECURITY] Fedora 11 Update: konq-plugins-4.4.0-3.fc11

Some additional plugins that interact with konqueror adblock: AdBlock plugin akregator: Add feeds directly to akregator kdepim is needed autorefresh: Refresh websites after a specifig period babelfish: Translate a website with babelfish crashes: Crash monitor dirfilter: Filter the current directo...

[SECURITY] Fedora 12 Update: konq-plugins-4.4.0-3.fc12

Some additional plugins that interact with konqueror adblock: AdBlock plugin akregator: Add feeds directly to akregator kdepim is needed autorefresh: Refresh websites after a specifig period babelfish: Translate a website with babelfish crashes: Crash monitor dirfilter: Filter the current directo...

CVE-2009-1885

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service application crash via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrat...

PYSEC-2009-5

schema.py in FormEncode for Python python-formencode 1.0 does not apply the chainedvalidators feature, which allows attackers to bypass intended access restrictions via unknown vectors...

DEBIAN-CVE-2008-6547

schema.py in FormEncode for Python python-formencode 1.0 does not apply the chainedvalidators feature, which allows attackers to bypass intended access restrictions via unknown vectors...

Fedora 9 : python-formencode-1.0.1-1.fc9 (2008-6312)

The formencode package helps create validators that can check and manipulate user input before passing it to the rest of the program. Version 1.0 silently ignored one class of validators chainedvalidators that run over a set of user input rather than individual pieces. Version 1.0.1 fixes that so...

[Full-disclosure] PacSec Hype Security Team: CGI.pm param injection

====================================================================== PacSec Hype Security Team param injection in CGI.pm and inheritors allows SQL injection and manipulation of data bypassing many perl web form validators ======================================================================...