93 matches found
Insufficiently Protected Credentials
Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials which leaks the Authorization header after a redirect to a different port on the same site. Remediation Upgrade mechanize to version 2.8.5 or higher. References - GitHub Commit - GitHub PR...
DEBIAN-CVE-2022-31033
The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site...
UBUNTU-CVE-2022-31033
The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site...
Mechanize 信息泄露漏洞
Mechanize is an open source ruby library from Sparkle Motion. It is used to automate interactions with websites. A security vulnerability exists in versions of Mechanize prior to 2.8.5 that stems from an authorization header that leaks after redirecting to a different port on the same site...
HTML5 Responsive FAQ <= 2.8.5 - Admin+ Stored Cross-Site Scripting
The plugin does not properly sanitise and escape some of its settings, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed PoC Put the following payload in the "Text size of answer in pixels" settings: alert'XSS';...
Cla-assistant Security Vulnerability
Cla-assistant is a Javascript-based contributor agreement management software from the Cla-assistant team that integrates with Github. The software provides the ability to ask for a signed CLA when a contributor pulls code. A security vulnerability exists in CLA-Assistant version 2.8.5 and earlie...
VMware Tanzu Application Service for VMs Unauthorized Access Vulnerability
VMware Tanzu Application Service for VMs is a suite of application development and deployment solutions from VMware. A security vulnerability exists in VMware Tanzu Application Service for VMs versions 2.6.x prior to 2.6.18, 2.7.x prior to 2.7.11, and 2.8.x prior to 2.8.5. An attacker could explo...
CVE-2019-19601
OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf...
WordPress Elementor Page Builder plugin <= 2.8.4 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability found by Impenetrable in WordPress Elementor Page Builder plugin versions = 2.8.4. Solution Update the WordPress Elementor Page Builder plugin to the latest available version at least 2.8.5...
PT-2020-20130 · Elementor · Elementor
Name of the Vulnerable Software and Affected Versions: Elementor plugin versions prior to 2.8.5 Description: The issue is related to a reflected XSS vulnerability on the elementor-system-info page. This can be exploited by targeting an authenticated user. Recommendations: For versions prior to...
CVE-2019-19601
OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf...
CVE-2019-19601
OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf...
Buffer overflow
OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf...
CVE-2019-19601
CVE-2019-19601 affects OpenDetex 2.8.5, with a buffer overflow in TexOpen in detex.l caused by an incorrect sprintf. The vulnerability’s impact is reflected in CVSS metrics (base score 6.8–7.8; confidentiality, integrity, and availability partial to high). Connected entries corroborate the issue ...
CVE-2019-19601
OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf...
CVE-2019-19601
OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf...
PYSEC-2019-4
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible...
PT-2023-10819 · Man Db +1 · Man-Db +1
Name of the Vulnerable Software and Affected Versions: man-db versions prior to 2.8.5 Description: The issue allows local users with access to the man user account to gain root privileges because /usr/bin/mandb is executed by root but not owned by root. Additionally, the owner can strip the setui...
Navigate CMS 2.8.5 - Arbitrary File Download Vulnerability
Exploit for php platform in category web applications Exploit Title: Navigate CMS 2.8.5 - Arbitrary File Download Exploit Author: Ihsan Sencan Vendor Homepage: https://www.navigatecms.com/ Software Link: http://master.dl.sourceforge.net/project/navigatecms/releases/navigate-2.8.5r1355.zip Version...