6115 matches found
phpCAS vulnerable to Service Hostname Discovery Exploitation
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...
CVE-2022-3797: URL Redirection to Untrusted Site
A vulnerability was found in eolinker apinto-dashboard. It has been rated as problematic. This issue affects some unknown processing of the file /login. The manipulation of the argument callback leads to open redirect. The attack may be initiated remotely. The exploit has been disclosed to the...
PT-2022-24167 · Eolinker · Eolinker Apinto-Dashboard
Name of the Vulnerable Software and Affected Versions: eolinker apinto-dashboard affected versions not specified Description: A problematic issue affects the processing of the file /login, where the manipulation of the callback argument leads to an open redirect. This issue can be initiated...
CVE-2022-3797
CVE-2022-3797 affects the eolinker apinto-dashboard login processing. Multiple connected sources describe an open redirect vulnerability caused by manipulation of the callback parameter in the /login path. The issue can be triggered remotely and the exploit has been disclosed publicly. Sources co...
CVE-2022-3804: Improper Neutralization
A vulnerability was found in eolinker apinto-dashboard. It has been classified as problematic. Affected is an unknown function of the file /login. The manipulation of the argument callback leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed ...
IBAX go-ibax SQL注入漏洞
IBAX go-ibax is a blockchain system platform from IBAX Corporation. IBAX go-ibax suffers from a SQL injection vulnerability that stems from unknown functionality in file/api/v2/open/tablesInfo, where manipulation of parameter callbacks leads to SQL injection...
PT-2022-24174 · Unknown · Eolinker Apinto-Dashboard
Name of the Vulnerable Software and Affected Versions: eolinker apinto-dashboard affected versions not specified Description: A problematic issue has been found, affecting an unknown function of the file /login. The manipulation of the callback argument leads to cross-site scripting. It is possib...
DEBIAN-CVE-2022-3697
A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...
UBUNTU-CVE-2022-3697
A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...
Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current curl Multiple Vulnerabilities (SSA:2022-299-01)
The version of curl installed on the remote host is prior to 7.86.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-299-01 advisory. - curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non- HTTPS URL, it sets up...
SUSE SLED15: curl / libcurl-devel / libcurl-devel-32bit / libcurl4 / etc (SUSE-SU-2022:3773-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3773-1 advisory. - CVE-2022-32221: Fixed POST following PUT confusion bsc1204383. Tenable has extracted the preceding...
POST following PUT confusion
When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the...
CVE-2022-32221
When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the...
UBUNTU-CVE-2022-32221
When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the...
PT-2022-5975
Name of the Vulnerable Software and Affected Versions libcurl versions prior to 7.86.0 Description When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPT READFUNCTION to ask for data to send, even when the CURLOPT POSTFIELDS option has been set, if the same handle...
Insufficient validation in enforcer's OnERC20Received() callback may lead to loss of funds in implementations.
Lines of code Vulnerability details Description HolographERC20's onERC20Received is presumably a callback that is called when the Holographer receives tokens. Its implementation is: if isEventRegisteredHolographERC20Event.beforeOnERC20Received requireSourceERC20.beforeOnERC20Receivedaccount,...
PT-2022-7598
Name of the Vulnerable Software and Affected Versions Ansible affected versions not specified Description A flaw was found in Ansible in the amazon.aws collection when using the tower callback parameter from the amazon.aws.ec2 instance module. This issue allows an attacker to take advantage of th...
Linux Kernel BPF r8152.c intr_callback logging of excessive data
...
OpenCATS Cross-Site Scripting Vulnerability (CNVD-2022-70589)
OpenCats is an open source recruitment process management system. A security vulnerability exists in OpenCats version v0.9.6, which stems from the fact that an attacker can utilize its callback component to implement reflective cross-site scripting. No detailed vulnerability details are available...
