802 matches found
NethServer 7.3.1611 - Cross-Site Request Forgery (Create User / Enable SSH Access) Vulnerability
Exploit for jsp platform in category web applications HTML Decoded PoC: history.pushState'', '', '/' input type="hidden"...
NethServer 7.3.1611 - Cross-Site Request Forgery (Create User Enable SSH Access)
NethServer 7.3.1611 - Cross-Site Request Forgery Create User Enable SSH Access HTML Decoded PoC: history.pushState'', '', '/' input type="hidden" name="AccountUsercreategrou...
NethServer 7.3.1611 CSRF Create User / Enable SSH Access
HTML Decoded PoC: history.pushState'', '', '/' input type="hidden" name="...
Unauthorized Extension Of Token Validity
simplesamlphp is vulnerable to having a token's validity period extended by an unauthorized party. The vulnerability is possible because there is a flaw in the calculateTokenValue function in TimeLimitedToken.php. The flaw allows an attacker to extend the prepended offset as much as needed to hit...
gnutls: Incorrect certificate validation when using OCSP responses (GNUTLS-SA-2016-3)
A flaw was found in the way GnuTLS validated certificates using OCSP responses. This could falsely report a certificate as valid under certain circumstances...
UBUNTU-CVE-2017-11104
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check...
PT-2017-11743 · Cz.Nic +1 · Knot Dns +1
Name of the Vulnerable Software and Affected Versions: Knot DNS versions prior to 2.4.5 Knot DNS versions 2.5.x prior to 2.5.2 Description: The issue is related to a flaw in the TSIG protocol implementation. This flaw allows an attacker with a valid key name and algorithm to bypass TSIG...
CVE-2016-10063
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service application crash or have other unspecified impact via a crafted file, related to extend validity...
CVE-2016-10063
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service application crash or have other unspecified impact via a crafted file, related to extend validity...
FreeBSD : cURL -- ocsp status validation error (311e4b1c-f8ee-11e6-9940-b499baebfeaf)
The cURL project reports : SSLVERIFYSTATUS ignored curl and libcurl support 'OCSP stapling', also known as the TLS Certificate Status Request extension using the CURLOPTSSLVERIFYSTATUS option. When telling curl to use this feature, it uses that TLS extension to ask for a fresh proof of the server...
CVE-2017-2629
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server...
SSL_VERIFYSTATUS ignored
curl and libcurl support "OCSP stapling", also known as the TLS Certificate Status Request extension using the CURLOPTSSLVERIFYSTATUS option. When telling curl to use this feature, it uses that TLS extension to ask for a fresh proof of the server's certificate's validity. If the server does not...
CURL-CVE-2017-2629 SSL_VERIFYSTATUS ignored
curl and libcurl support "OCSP stapling", also known as the TLS Certificate Status Request extension using the CURLOPTSSLVERIFYSTATUS option. When telling curl to use this feature, it uses that TLS extension to ask for a fresh proof of the server's certificate's validity. If the server does not...
Input validation
An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpda...
CVE-2016-8212
An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpda...
CVE-2016-8212
An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpda...
CVE-2016-10063
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service application crash or have other unspecified impact via a crafted file, related to extend validity...
XMS is unable to connect to DEP - Error: "Connection failed" when testing the connection
In the XMS console, inside iOS Bulk Enrollment DEP Configuration, when importing the Token file from the DEP Portal, the connectivity test is failing with error "Connection Failed". However, XMS connectivity tests are showing that XMS is able to reach Apple's websites, the ports are correctly...
Information disclosure
Cisco WebEx Meeting Center Original Release Base allows remote attackers to obtain sensitive information about username validity by 1 attending or 2 hosting a meeting, aka Bug ID CSCux84312...
