6645 matches found
CVE-2021-23514: Improper Limitation of a Pathname to a Restricted Directory
This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files from the server...
CVE-2022-22156
An Improper Certificate Validation weakness in the Juniper Networks Junos OS allows an attacker to perform Person-in-the-Middle PitM attacks when a system script is fetched from a remote source at a specified HTTPS URL, which may compromise the integrity and confidentiality of the device. The...
Information Disclosure
follow-redirects is vulnerable to information disclosure. The cookie is exposed when the system is fetching a remote url with the redirect...
The vulnerability of the Google Chrome browser’s Background Fetch API programming interface, related to the disclosure of information in the erroneous data area, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Background Fetch API programming interface in Google Chrome browsers is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...
The vulnerability of the Google Chrome browser’s Background Fetch API interface, related to the disclosure of information in the erroneous data area, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Background Fetch API programming interface in Google Chrome browsers is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...
in lquixada/cross-fetch
BUG ====== Cookie header leaked to third party site and it allow to hijack victim account SUMMURY ============ When fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to...
PT-2022-3647 · Lquixada · Cross-Fetch
Name of the Vulnerable Software and Affected Versions: lquixada/cross-fetch versions prior to 3.1.5 Description: The issue is related to the exposure of private personal information to an unauthorized actor. It is associated with errors in handling files, specifically cookies, in the WHATWG Fetch...
IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF
The plugin does not have CSRF check in the ip2locationcountryblockersaverules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend. Make an admin open a page with the following code in it, whi...
IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country Ban
The plugin does not have authorisation and CSRF checks in the ip2locationcountryblockersaverules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend. v2.26.5 added...
PT-2021-27999
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-use-after-free READ 4 crash has been reported. The crash state includes zend jit fetch dim r helper, zero, and zend execute. No information is...
The vulnerability of the browser’s Background Fetch API programming interface in Google Chrome allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Google Chrome browser’s software interface is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
Security update for chromium (important)
openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2021:1632-1 Rating: important References: 1192310 1192734 1193519 1193713 Cross-References: CVE-2021-38005 CVE-2021-38006 CVE-2021-38007 CVE-2021-38008 CVE-2021-38009 CVE-2021-38010 CVE-2021-38011 CVE-2021-38012...
GSD-2021-1002729 bpf: Fix kernel address leakage in atomic fetch
bpf: Fix kernel address leakage in atomic fetch This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.11 by commit...
PT-2021-27197
Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.12 through v5.15.10 Description The issue concerns kernel address leakage in atomic fetch. It was introduced in version v5.12 and fixed in version v5.15.11. The actual impact and attack plausibility have not yet been...
DEBIAN-CVE-2021-3621
A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest...
CVE-2021-38016
Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted HTML page...
DEBIAN-CVE-2021-38016
Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted HTML page...
CVE-2021-38016
Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted HTML page...
