174 matches found
Withdrawn Advisory: Weights and Biases (wandb) has a Server-Side Request Forgery (SSRF) vulnerability
Withdrawn Advisory This advisory has been withdrawn because the underlying issue existed in Weights and Biases's backend server code, not the software development kit included in the wandb PyPI package, as originally reported. This link is maintained to preserve external references. Original...
CVE-2024-4642
CVE-2024-4642 is described in connected advisories as a Server-Side Request Forgery (SSRF) in the wandb/wandb repository, caused by improper handling of HTTP redirects (HTTP 302). The issue could allow team members with access to the Webhooks settings to reach internal HTTP(S) endpoints, with pot...
Fedora 37 : pypy3.9 (2023-af5206f71d)
The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-af5206f71d advisory. Update to 7.3.11. See https://doc.pypy.org/en/latest/release-v7.3.11.html Security fix for CVE-2022-37454, CVE-2022-45061, CVE-2022-42919. Tenable h...
EulerOS Virtualization 2.11.0 : python-urllib3 (EulerOS-SA-2024-1435)
According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide...
Huawei EulerOS: Security Advisory for python-urllib3 (EulerOS-SA-2024-1296)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Cross site scripting
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting UXSS on a victim website, if the victim had a link to the attacker's website. This vulnerability affects Focus for iOS 123...
CVE-2024-26284
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting UXSS on a victim website, if the victim had a link to the attacker's website. This vulnerability affects Focus for iOS 123...
CVE-2024-26284
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting UXSS on a victim website, if the victim had a link to the attacker's website. This vulnerability affects Focus for iOS 123...
CVE-2024-26284
Focus for iOS is affected by a UXSS vulnerability that can be triggered via a 302 redirect if a victim site links to the attacker’s site. The issue is described for all Focus for iOS versions prior to 123, with remediation implemented in Focus for iOS 123 and later. The root cause involves improp...
PT-2024-21332 · Unknown · Focus For Ios
Name of the Vulnerable Software and Affected Versions: Focus for iOS versions prior to 123 Description: This issue allows an attacker to conduct a Universal Cross-Site Scripting UXSS attack on a victim website using a 302 redirect, provided the victim has a link to the attacker's website...
Security Vulnerabilities fixed in Focus for iOS 123 — Mozilla
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting UXSS on a victim website, if the victim had a link to the attacker's website...
CVE-2023-49103
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...
Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : pip vulnerabilities (USN-6473-2)
The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6473-2 advisory. USN-6473-1 fixed vulnerabilities in urllib3. This update provides the corresponding updates for the...
CVE-2023-47549
Unauth. Reflected Cross-Site Scripting XSS vulnerability on 302 response page in spider-themes EazyDocs plugin = 2.3.3 versions...
CVE-2023-47549 WordPress EazyDocs Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability on 302 response page in spider-themes EazyDocs plugin = 2.3.3 versions...
CVE-2023-47549
CVE-2023-47549 is an unauthenticated reflected XSS in EazyDocs for WordPress (spider-themes) affecting <=2.3.3 (and up to
Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-302)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-302 advisory. ASP.NET and Visual Studio Security Feature Bypass Vulnerability CVE-2023-33170 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus...
Fortinet Fortigate SSH authentication bypass when RADIUS authentication is used (FG-IR-22-255)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-255 advisory. - An authentication bypass by assumed-immutable data vulnerability CWE-302 in the FortiOS SSH login component 7.2.0, 7.0.0...
rebindMultiA - Tool To Perform a Multiple A Record Rebind Attack
rebindMultiA is a tool to perform a Multiple A Record rebind attack. rebindmultia.com is a domain that I've set up to assist with these attacks. It makes every IP its own authoritative nameserver for the domain IP.ns.rebindmultia.com. For example, 13.33.33.37.ns.rebindmultia.com's authoritative...
AlmaLinux 8 : python27:2.7 (ALSA-2023:2860)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:2860 advisory. Python: CPU denial of service via inefficient IDNA decoder CVE-2022-45061 Tenable has extracted the preceding description block directly from the AlmaLinux securit...