96 matches found
CVE-2020-5263
auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...
CVE-2020-5263
The CVE-2020-5263 entry concerns the Auth0.js (NPM package auth0-js) library. Affected versions are greater than 8.0.0 and before 9.12.3, where an authentication error returns an error object that may contain the user’s original request, potentially exposing the plaintext password if logged or ex...
CVE-2020-5263 Information disclosure through error object
auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...
CVE-2019-5263
CVE-2019-5263 affects Huawei HiSuite (9.1.0.305 and earlier; 9.1.0.305 MAC) and HwBackup (before 9.1.1.308). The issue is a brute-forcing vulnerability against the encrypted backup password, enabling extraction of backed-up Huawei device data. Huawei’s security advisory HWPSIRT-2019-08102 notes a...
Security Advisory - Brute Forcing Encrypted Backup Data Vulnerability on Huawei Smartphones
There is a vulnerability that Huawei smartphone user backup information can be obtained by brute forcing the password for encrypting the backup. Vulnerability ID: HWPSIRT-2019-08102 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2019-5263. Huawei has...
Mutiny Monitoring Appliance Command Injection Vulnerability
Mutiny Monitoring Appliance is a network monitoring appliance from Mutiny UK. A command injection vulnerability exists in the maintenance.cgi file in versions prior to Mutiny Monitoring Appliance 6.1.0-5263. An attacker can use this vulnerability to inject arbitrary commands into the file name...
Joomla! Easydiscuss Cross Site Scripting
Exploit Title: Joomla Plugin Easydiscuss inside the body, everything after the will be executed in the useras browser. Works with every version up to 4.0.20 2. Proof of Concept Login with permissions to post a message, insert in the body and add any html code after that, whenever a user tries to...
Joomla Easydiscuss Component < 4.0.21 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Joomla Plugin Easydiscuss inside the body, everything after the will be executed in the user’s browser. Works with every version up to 4.0.20 2. Proof of Concept Login with permissions to post a message, insert in the body and a...
Joomla! Component Easydiscuss 4.0.21 - Cross-Site Scripting
Joomla! Component Easydiscuss 4.0.21 - Cross-Site Scripting Exploit Title: Joomla Plugin Easydiscuss inside the body, everything after the will be executed in the user’s browser. Works with every version up to 4.0.20 2. Proof of Concept Login with permissions to post a message, insert in the body...
Joomla! Component Easydiscuss < 4.0.21 - Cross-Site Scripting
Exploit Title: Joomla Plugin Easydiscuss inside the body, everything after the will be executed in the user’s browser. Works with every version up to 4.0.20 2. Proof of Concept Login with permissions to post a message, insert in the body and add any html code after that, whenever a user tries to...
CVE-2018-5263
creationtimestamp| type| source ---|---|--- 2018-01-10 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43488...
CVE-2018-5263
The StackIdeas EasyDiscuss aka comeasydiscuss extension before 4.0.21 for Joomla! allows XSS...
CVE-2017-5263
Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically implemented as randomized per-session tokens associated with any web application function, especially destructive ones...
CVE-2017-5263
Cambium Networks cnPilot firmware versions 4.3.2-R4 and earlier are affected by a CSRF vulnerability caused by lack of CSRF protection in the web interface. The CNVD entry for CNVD-2018-01037 (and the CVE-2017-5263 record) indicate an attacker could misuse CSRF to obtain or change the administrat...
CVE-2015-5263
The CVE-2015-5263 issue affects pulp-consumer-client versions 2.4.0 through 2.6.3. Concrete detail from connected CNVD entry: a design flaw where the client fails to detect the server’s TLS certificate signature when obtaining the server’s public key during registration. Reported impact states an...
openSUSE Security Update : Thunderbird (openSUSE-2016-1120)
update to Thunderbird 45.3.0 boo991809 - Disposition-Notification-To could not be used in mail.compose.other.header - 'edit as new message' on a received message pre-filled the sender as the composing identity. - Certain messages caused corruption of the drafts summary database. security fixes :...
FreeBSD : Mozilla -- multiple vulnerabilities (aa1aefe3-6e37-47db-bfda-343ef4acb1b5)
Mozilla Foundation reports : Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution a...
openSUSE Security Update : MozillaThunderbird (openSUSE-2016-1057)
This update for MozillaThunderbird fixes the following issues : - update to Thunderbird 45.3.0 boo991809 - Disposition-Notification-To could not be used in mail.compose.other.header - 'edit as new message' on a received message pre-filled the sender as the composing identity. - Certain messages...
SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2016:2195-1)
Mozilla Firefox was updated to 45.3.0 ESR to fix the following issues bsc991809 : - MFSA 2016-62/CVE-2016-2835/CVE-2016-2836 Miscellaneous memory safety hazards rv:48.0 / rv:45.3 - MFSA 2016-63/CVE-2016-2830 Favicon network connection can persist when page is closed - MFSA 2016-64/CVE-2016-2838...
Updated firefox packages fix security vulnerability
Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2016-2836, CVE-2016-5258, CVE-2016-5259, CVE-2016-5252,...