DEBIAN-CVE-2015-5236

It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy SOP checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value...

UBUNTU-CVE-2015-5236

It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy SOP checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value...

CVE-2015-5236

The CVE-2015-5236 entry concerns IcedTea-Web, where the codebase attribute of the HTML tag used in the SOP check is not required to match the applet’s actual origin. This could allow a malicious site to bypass Same Origin Policy by spoofing the codebase value. Public documentation provided refer...

RHEL 7 : kernel-rt (RHSA-2022:5236)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5236 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

AlmaLinux 8 : postgresql:13 (ALSA-2021:5236)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:5236 advisory. postgresql: memory disclosure in certain queries CVE-2021-3677 postgresql: server processes unencrypted bytes from man-in-the-middle CVE-2021-23214 Tenabl...

Oracle Linux 8 : postgresql:13 (ELSA-2021-5236)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-5236 advisory. postgresql 13.5-1 - Update to 13.5 - Resolves: 2024608 Tenable has extracted the preceding description block directly from the Oracle Linux security...

CentOS 8 : postgresql:13 (CESA-2021:5236)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:5236 advisory. - postgresql: server processes unencrypted bytes from man-in-the-middle CVE-2021-23214 - postgresql: memory disclosure in certain queries CVE-2021-3677...

Oracle Linux 8 : thunderbird (ELSA-2020-5236)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5236 advisory. 78.5.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 78.5.0-1 - Update to 78.5.0 build3 Tenable has...

CVE-2012-5236

CVE-2012-5236 is rejected and does not represent an active vulnerability entry.

chellow (>=2050.0.0 <=2243.0.0), dcicsnovault (>=2.0.0b0 <=2.0.0b11) +11 more potentially affected by CVE-2020-5236 via waitress (>=0.8.10 <=1.4.2)

waitress PYPI version =0.8.10, =2050.0.0, =2.0.0b0, =1.4.0, =17.4.0, =1.1.0.dev20170908, =1.3.7, =0.9.1, =1.0.3, =1.0.5 Source cves: CVE-2020-5236 Source advisory: OSV:PYSEC-2020-155...

CVE-2020-5236

Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and...

chellow (>=2234.0.0 <=2243.0.0), kinto-dist (=18.0.2) potentially affected by CVE-2020-5236 via waitress (=1.4.2)

waitress PYPI version =1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on waitress and may be impacted: - chellow =2234.0.0, =2243.0.0 - kinto-dist =18.0.2 Source cves: CVE-2020-5236 Source advisory: OSV:GHSA-73M2-3PWG-5FGC...

CVE-2020-5236

CVE-2020-5236 affects the Python WSGI server waitress. A flaw in the regex used to validate incoming HTTP headers allows catastrophic backtracking when headers contain invalid characters (e.g., Bad-header: xxxxxxxxxxxxxxx\x10), causing the server to hit 100% CPU and deny service. The issue was in...

CVE-2014-5236

CVE-2014-5236 affects Open-Xchange AppSuite, where the documentconverter component is vulnerable to absolute path traversal via crafted OLE Objects or images in OpenDocument text files. The impact is reading sensitive server files. Vendors provided fixes in versions: 7.4.2-rev10 and 7.6.0-rev10. ...

CVE-2019-5236

Huawei smart phones Emily-L29C with versions of 8.1.0.132aC432, 8.1.0.135C782, 8.1.0.154C10, 8.1.0.154C461, 8.1.0.154C635, 8.1.0.156C185, 8.1.0.156C605, 8.1.0.159C636 have a double free vulnerability. An attacker can trick a user to click a URL to exploit this vulnerability. Successful exploitati...

CVE-2019-5236

Huawei smart phones Emily-L29C with versions of 8.1.0.132aC432, 8.1.0.135C782, 8.1.0.154C10, 8.1.0.154C461, 8.1.0.154C635, 8.1.0.156C185, 8.1.0.156C605, 8.1.0.159C636 have a double free vulnerability. An attacker can trick a user to click a URL to exploit this vulnerability. Successful exploitati...

CVE-2019-5236

CVE-2019-5236 affects Huawei smart phones Emily-L29C (Android 8.1) with firmware versions 8.1.0.132a(C432), 8.1.0.135(C782), 8.1.0.154(C10/C461/C635), 8.1.0.156(C185/C605), 8.1.0.159(C636). The issue is a double-free vulnerability in the system, exploitable by convincing a user to open a crafted ...

CVE-2016-5236

creationtimestamp| type| source ---|---|--- 2019-07-01 20:29:07+00:00| seen| https://t.me/cibsecurity/5271...

CVE-2016-5236

Cross-Site-Scripting XSS vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account or signature...

CVE-2016-5236

CVE-2016-5236 affects F5 WebSafe Dashboard (3.9.5 and earlier). The vulnerability is a Cross-Site Scripting (XSS) flaw that enables a privileged authenticated user to inject arbitrary script/HTML when creating a new user, account, or signature. The F5 advisory lists vulnerable products/features a...