CVE-2019-10160

A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies,...

Cisco Unified Intelligence Center Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model DOM-based, environment or client-side cross-site scripting XSS attack. The vulnerability occurs because...

PYSEC-2019-93

All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control...

The vulnerability of the Microprogramming Software of the ConneXium TSXETG100 firewall lies in the insufficient protection of the web page structure, allowing attackers to execute arbitrary scripts within the user’s web interface.

The vulnerability of the Microprogrammed Software for the ConneXium TSXETG100 firewall lies in the insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary scripts in the context of the current web interface user, using a...

CVE-2018-14711

Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to cause state-changing actions with specially crafted URLs...

HackerOne: Open Redirection in [https://www.hackerone.com/index.php]

You are resolved open redirect issue report 439075.This report publicly disclosed. but this issue again work at this time. When a user visit http://www.hackerone.com/index.php/index.php.evil.com user will be redirected to www.hackerone.com.evil.com Steps To Reproduce Click on this link...

ALPINE-CVE-2019-11068

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...

Mozilla Firefox Firefox Developer Tools Code Execution Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation.Firefox Developer Tools is one of the developer tools component. A security vulnerability exists in Firefox Developer Tools in versions of Mozilla Firefox prior to 66 on the macOS platform. The vulnerability can be exploite...

Arbitrary File Download Vulnerability in YxtCMF Online Learning System v3.1

YxtCMF online learning system is an online learning platform system developed with thinkphp+bootstrap as the framework. YxtCMF Online Learning System v3.1 has an arbitrary file download vulnerability, attackers can login to the system to construct URLs to download arbitrary files...

CVE-2019-9636

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding with an incorrect netloc during NFKC normalization. The impact is: Information disclosure credentials, cookies, etc. that are cached against a given hostname. The components are:...

PT-2019-16739 · Prometheus +1 · Prometheus +1

Name of the Vulnerable Software and Affected Versions: Prometheus versions prior to 2.7.1 Description: A stored, DOM based, cross-site scripting XSS flaw was found. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the...

CVE-2018-20150

In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins...

CVE-2018-20150

In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins...

DEBIAN-CVE-2018-20150

In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins...

CVE-2018-20150

In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins...

Design/Logic Flaw

In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins...

UBUNTU-CVE-2018-20150

In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins...

CVE-2018-20150

In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins...

CVE-2018-20150

In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins...

Jenkins < 2.154 and < 2.138.4 LTS Multiple Vulnerabilities - Windows

Jenkins is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...