960 matches found
Escape sequence injection vulnerability in the Basic authentication of WEBrick
There is an escape sequence injection vulnerability in the Basic authentication of WEBrick bundled by Ruby. When using the Basic authentication of WEBrick, clients can pass an arbitrary string as the user name. WEBrick outputs the passed user name intact to its log, then an attacker can inject...
Legal Robot: Null Byte Injection in all fields of Profile
Hi Team, Null byte injection is possible in all the fields of Edit Profile functionality. Affected URL: https://app.legalrobot.com/account Description: Possible Injection of control characters, such as Null Byte 0x00, \000, \x00, \z, or the Unicode representation \u0000 into vulnerable fields in...
Legal Robot: Meta characters are not filtered into full name on profile page
A security researcher discovered that ASCII control characters were allowed in the user's profile fields. A simple change now strips these characters from fields like First Name, Last Name, etc...
Fedora 26 : wordpress (2017-2ae4a42cd4)
WordPress 4.7.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.7.2 and earlier are affected by six security issues : - Cross-site scripting XSS via media file metadata. Reported by Chris...
NfSen 1.3.7 / AlienVault USM/OSSIM 5.3.4 Command Injection
Exploit Title: NfSen/AlienVault remote root exploit IPC query command injection Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault 5.3.4 Date: 2017-07-10 Vendor Homepage: http://nfsen.sourceforge.net/ Vendor Homepage:...
MGASA-2017-0104 Updated wget packages fix security vulnerability
Wget up untill version 1.19.1 does not ensure control characters are not used in the hostname part of a url. This security update rejects control characters in host part of a url...
Updated wget packages fix security vulnerability
Wget up untill version 1.19.1 does not ensure control characters are not used in the hostname part of a url. This security update rejects control characters in host part of a url...
SUSE-SU-2017:0799-1 Security update for wget
This update for wget fixes the following issues: Security issue fixed: - CVE-2017-6508: urlparse: Reject control characters in host part of URL bsc1028301...
SUSE-SU-2017:0800-1 Security update for wget
This update for wget fixes the following issues: Security issue fixed: - CVE-2017-6508: urlparse: Reject control characters in host part of URL bsc1028301...
Rockstar Games: Profile bio at rockstar is accepting control characters
This report involved the injection of control characters, such as Null Byte 0x00, into the profile Bio field in order to cause unexpected, harmful behaviors. Our solution was to both block control characters from being saved on the backend when included in user-input, as well as to suppress the...
Fedora 24 : wordpress (2017-7e0b84ffad)
WordPress 4.7.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.7.2 and earlier are affected by six security issues : - Cross-site scripting XSS via media file metadata. Reported by Chris...
Input validation
In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...
DEBIAN-CVE-2017-6815
In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...
CVE-2017-6815
In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...
CVE-2017-6815
In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...
UBUNTU-CVE-2017-6815
In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...
CVE-2017-6815
In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...
wordpress -- multiple vulnerabilities
WordPress versions 4.7.2 and earlier are affected by six security issues. Cross-site scripting XSS via media file metadata. Control characters can trick redirect URL validation. Unintended files can be deleted by administrators using the plugin deletion functionality. Cross-site scripting XSS via...
Nextcloud: Version 4.7.2 of wordpress is vulnerable
Hello team, I observed that your website https://nextcloud.com still use wordpress 4.7.2 Version 4.7.2 of wordpress is vulnerable to : Cross-site scripting XSS Control characters can trick redirect URL validation Cross-site scripting XSS via video URL in YouTube embeds Cross-site scripting XSS vi...
Rockstar Games: Control Character Injection In Messages
This report involved the injection of control characters, such as Null Byte 0x00, into vulnerable fields in the Message endpoints in order to cause unexpected, harmful behaviors. Our solution was to both block control characters from being saved on the backend when included in user-input, as well...