Insufficiently Protected Credentials

Overview @hapi/wreck is a HTTP Client Utilities library. Affected versions of this package are vulnerable to Insufficiently Protected Credentials due to leaking the sensitive Proxy-Authorization header across cross-hostname redirects. An attacker can obtain sensitive proxy credentials by inducing...

@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects

Impact When @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped. The standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the...

CVE-2025-5819

An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances...

CVE-2025-2938

An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval...

Apple Safari 18.1.1 Multiple Vulnerabilities (121756)

The version of Apple Safari installed on the remote host is prior to 18.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 121756 advisory. - The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequo...

Apple iOS < 18.1.1 Multiple Vulnerabilities (121752)

Binary data appleios1811check.nbin...

Vulnerabilities fixed in Apple macOS and Safari

Apple has fixed several vulnerabilities in macOS and Safari. Two vulnerabilities CVE-2024-44308 & CVE-2024-44309 in present in macOS Sequoia and Safari 18.1.1 can lead to execution of arbitrary code. Apple indicates that active exploits of these vulnerabilities have been taking place on Intel-bas...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS before 18.1.1 and Apple iPadOS before 18.1.1, which stems from the fact that...

Apple Safari Security Update (HT121756)

Apple Safari is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:safari"; ifdescription...

CVE-2024-44309

CVE-2024-44309 concerns a cookie management issue in Apple environments. The root cause is improper state management that can enable cross-site scripting when processing malicious web content. Affected products/versions include Safari 18.1.1, iOS 17.7.2, iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 1...

CVE-2024-44309

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. App...

About the security content of Safari18.1.1

About the security content of Safari18.1.1 This document describes the security content of Safari 18.1.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

PT-2024-8648 · Apple +9 · Ios +14

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 18.1.1 iOS versions prior to 17.7.2 and 18.1.1 iPadOS versions prior to 17.7.2 and 18.1.1 macOS Sequoia versions prior to 15.1.1 visionOS versions prior to 2.1.1 Description: The issue is related to a cookie managemen...

VulnCheck KEV: CVE-2019-25065

A vulnerability was found in OpenNetAdmin 18.1.1. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to privilege escalation. The attack may be launched remotely. The exploit has been disclosed to the public and may be used...

CVE-2019-25065

A vulnerability was found in OpenNetAdmin 18.1.1. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to privilege escalation. The attack may be launched remotely. The exploit has been disclosed to the public and may be used...

CVE-2019-25065

A vulnerability was found in OpenNetAdmin 18.1.1. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to privilege escalation. The attack may be launched remotely. The exploit has been disclosed to the public and may be used...

CVE-2019-25065

OpenNetAdmin 18.1.1 is affected by CVE-2019-25065, described as a critical OS command injection that enables remote privilege escalation. The CIRCL/CVE sightings reference a Metasploit module (opennetadmin_ping_cmd_injection.rb), indicating an exploitable command-injection path. The vulnerability...

DEBIAN-CVE-2020-35776

A buffer overflow in respjsipdiversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses...

PT-2020-6069 · Yargs +4 · Yargs-Parser +4

Name of the Vulnerable Software and Affected Versions: yargs-parser versions prior to 13.1.2 yargs-parser versions prior to 15.0.1 yargs-parser versions prior to 18.1.1 Description: The issue is related to the yargs-parser library, which can be tricked into adding or modifying properties of...

OpenNetAdmin 18.1.1 - Command Injection Exploit #RCE

Exploit for php platform in category web applications class MetasploitModule 'OpenNetAdmin Ping Command Injection', 'Description' = %q This module exploits a command injection in OpenNetAdmin between 8.5.14 and 18.1.1. , 'Author' = 'mattpascoe', Vulnerability discovery 'Onur ER ' Metasploit modul...