CVE-2020-11585: Use of Insufficiently Random Values

There is an information disclosure issue in DNN formerly DotNetNuke 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager other than ones contained in a secure folder by sending themselves a message...

MISP Information Disclosure Vulnerability (CNVD-2020-23173)

MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in the app/Model/feed.php file in versions of MISP prior t...

[SECURITY] [DSA 4650-1] qbittorrent security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4650-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 02, 2020 https://www.debian.org/security/faq -...

python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

PT-2020-12610 · Phpmyadmin +2 · Phpmyadmin +2

Name of the Vulnerable Software and Affected Versions: phpMyAdmin version 5.0.2 Description: The issue allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. The vendor states that they do not see anything...

PayloadsAllTheThings

This repository is an offensive tool for API key and bucket S3 exploitation. It contains tools and exploits for various types of attacks, including CRLF injection, CSRF injection, and API key leaks. The repository includes a variety of scripts and modules for different types of attacks, such as...

CVE-2019-15124

In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL131, REL132, and REL133...

Design/Logic Flaw

In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL131, REL132, and REL133...

CVE-2019-15124

The CVE-2019-15124 entry refers to a stored/reflected cross-site scripting (XSS) vulnerability in the MobileFrontend extension for MediaWiki, specifically in the edit summary field of the watchlist feed. Affected branches are REL1_31, REL1_32, and REL1_33. The vulnerability arises from XSS in the...

CVE-2019-15124

In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL131, REL132, and REL133...

CVE-2019-15124: Improper Neutralization of Input During Web Page Generation

In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL131, REL132, and REL133...

PT-2020-9662

Name of the Vulnerable Software and Affected Versions MediaWiki MobileFrontend extension versions REL1 31 through REL1 33 Description The issue exists within the edit summary field of the watchlist feed, allowing for XSS. Recommendations For versions REL1 31 through REL1 33, update to a version...

CVE-2020-8467

creationtimestamp| type| source ---|---|--- 2020-03-18 10:15:02+00:00| exploited| https://t.me/SecLabNews/7124 2021-11-08 08:58:20+00:00| seen| MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422 2021-11-20 09:53:52+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-05 03:17:32+00:00| seen|...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

[SECURITY] Fedora 31 Update: python-feedgen-0.9.0-1.fc31

Feedgenerator This module can be used to generate web feeds in both ATOM and RSS format. It has support for extensions. Included is for example an exten sion to produce Podcasts...

CVE-2019-18988

creationtimestamp| type| source ---|---|--- 2020-02-07 15:33:38+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/credentials/teamviewerpasswords.rb 2020-02-21 03:55:25+00:00| exploited| https://t.me/informationsecuritychannel/35219 2021-11-08...

Talos Takes back with new episode, feed

By Jon Munshaw. Talos Takes, our new bite-size podcast, is back with its own feed and a new show. We first unveiled Talos Takes in early December, and took some time to develop a new Talos Podcasts page to accommodate Talos Takes and Beers with Talos. Now you have two Talos shows you can subscrib...

Cross site scripting

Cross-site scripting XSS vulnerability in vwrooms/js/jsor-jcarousel/examples/specialtextscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allows remote attackers to inject arbitrary web script or HTML via a URL to a crafted SVG file in the feed parameter...

CVE-2014-8338

Cross-site scripting XSS vulnerability in vwrooms/js/jsor-jcarousel/examples/specialtextscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allows remote attackers to inject arbitrary web script or HTML via a URL to a crafted SVG file in the feed parameter...

PT-2020-7750

Name of the Vulnerable Software and Affected Versions VideoWhisper Webcam plugins for Drupal versions 7.x Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file in the...