8975 matches found
HTTP Request Smuggling. A how-to
TL;DR HTTP Request Smuggling is not a new issue, a 2005 white paper from Watchfire discusses it in detail and there are other resources too. What I found missing was practical, actionable, how-to references. This post covers my findings and, hopefully, sheds some light on the intricacies of HTTP...
January 31, 2020—KB4539601 (Preview of Monthly Rollup)
None None...
PT-2020-5625 · Red Hat +3 · Ceph +3
Name of the Vulnerable Software and Affected Versions: Ceph affected versions not specified Description: A flaw in the Ceph RGW Beast front-end's handling of unexpected disconnects allows an authenticated attacker to make multiple disconnect attempts, resulting in a permanent leak of a socket...
CVE-2020-1700
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by...
CVE-2012-6609
Directory traversal vulnerability in agetlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...
CVE-2012-6610
Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; semicolon to the ping command feature...
CVE-2012-6609
CVE-2012-6609 is a directory traversal in Polycom HDX Video Endpoints (before 3.0.4) and UC APL (before 2.7.1.J). An attacker can read arbitrary files by supplying .. in the name parameter via a_getlog.cgi. The NVD entry reports CVSSv2 base score 5.0 (MEDIUM) and CVSSv3.1 base score 7.5 (HIGH), w...
CVE-2012-6609
Directory traversal vulnerability in agetlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...
CVE-2012-6610
Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; semicolon to the ping command feature...
CVE-2012-6610
CVE-2012-6610 affects Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J. The vulnerability is a command injection that allows remote authenticated users to execute arbitrary commands via the ping feature, demonstrated by using a semicolon to inject commands. Evidence from multip...
January 23, 2020—KB4534307 (OS Build 14393.3474)
None None...
January 23, 2020—KB4534318 (OS Build 16299.1654)
None None...
January 23, 2020—KB4534308 (OS Build 17134.1276)
None None...
Contact Form Clean and Simple < 4.7.1 - Authenticated Stored XSS
The Contact Form Clean and Simple WordPress plugin was vulnerable to Authenticated stored XSS. When a user has admin capabilities, malicious code can be submitted through the plugin's options. This code will then be executed on every page with the contact form on the front-end. By checking the...
Contact Form Clean and Simple < 4.7.1 - Authenticated Stored XSS
The Contact Form Clean and Simple WordPress plugin was vulnerable to Authenticated stored XSS. When a user has admin capabilities, malicious code can be submitted through the plugin's options. This code will then be executed on every page with the contact form on the front-end. PoC By checking th...
DEBIAN-CVE-2020-7595
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation...
CVE-2020-7595
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation...
ALPINE-CVE-2020-7595
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation...
