CVE-2020-14055

Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output encoding...

CVE-2020-14055

Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output encoding...

Cross site scripting

Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output encoding...

CVE-2020-14055

Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output encoding...

EulerOS Virtualization 3.0.6.0 : python-ecdsa (EulerOS-SA-2020-1773)

According to the version of the python-ecdsa package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER...

PT-2020-4159 · Microsoft +3 · Asp.Net Core +3

Name of the Vulnerable Software and Affected Versions: ASP.NET Core affected versions not specified Description: A security feature bypass issue exists in the way ASP.NET Core parses encoded cookie names. The ASP.NET Core cookie parser decodes entire cookie strings, which could allow a malicious...

Rockwell Automation FactoryTalk View SE Password Weak Encoding Vulnerability

Rockwell Automation FactoryTalk View SE is an industrial automation system view interface from Rockwell Automation. A weak password encoding vulnerability exists in Rockwell Automation FactoryTalk View SE, which can be exploited by an attacker to gain full access to a user's operating system and...

GHSA-P8C3-7RJ8-Q963 ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign

Impact Jsrsasign supports ECDSA signature validation which signature value is represented by ASN.1 DER encoding. This vulnerablity may accept a wrong ASN.1 DER encoded ECDSA signature such as: - wrong multi-byte ASN.1 length of TLV ex. 0x820045 even though 0x45 is correct - prepending zeros with...

ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign

Impact Jsrsasign supports ECDSA signature validation which signature value is represented by ASN.1 DER encoding. This vulnerablity may accept a wrong ASN.1 DER encoded ECDSA signature such as: - wrong multi-byte ASN.1 length of TLV ex. 0x820045 even though 0x45 is correct - prepending zeros with...

UBUNTU-CVE-2020-11538

In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311...

EulerOS Virtualization for ARM 64 3.0.6.0 : python2-ecdsa (EulerOS-SA-2020-1711)

According to the version of the python2-ecdsa package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A flaw was found in python-ecdsa, where it did not correctly verify whether signatures used DER encoding. Without...

Rockwell Automation FactoryTalk View SE

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Low skill level to exploit Vendor: Rockwell Automation Equipment: FactoryTalk View SE Vulnerabilities: Cleartext Storage of Sensitive Information, Weak Encoding for Password 2. RISK EVALUATION Successful exploitation of these vulnerabilities could lead...

Partial password leak over DNS on HTTP redirect

libcurl can be tricked to prepend a part of the password to the hostname before it resolves it, potentially leaking the partial password over the network and to the DNS servers. libcurl can be given a username and password for HTTP authentication when requesting an HTTP resource - used for HTTP...

CURL-CVE-2020-8169 Partial password leak over DNS on HTTP redirect

libcurl can be tricked to prepend a part of the password to the hostname before it resolves it, potentially leaking the partial password over the network and to the DNS servers. libcurl can be given a username and password for HTTP authentication when requesting an HTTP resource - used for HTTP...

CVE-2020-10274

MiR robots are affected by CVE-2020-10274 in combination with CVE-2020-10273. Affected products include MiR100, MiR200, MiR250, MiR500, MiR1000 and MiR Fleet, with MiR Robot Software versions prior to 2.10.2.1 (per ICS advisory) and older firmware versions (MiR controllers prior to 2.8.1.1) per N...

CVE-2020-13822

The Elliptic for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature...

Exploit for Improper Encoding or Escaping of Output in F5 Nginx

It is an open-source collection of pre-built vulnerable docker environments. The primary CVE ID is not explicitly stated, but the repository contains various vulnerable environments and exploits for different vulnerabilities, including CVE-2016-9086, CVE-2017-1000353, CVE-2013-4547,...

Denial Of Service (DoS)

libvncserver.so is vulnerable to denial of service DoS attack. The issue exists as an out-of-bounds access can occur from the encoding function in libvncserver/hextile.c...

Denial Of Service (DoS)

libvncserver.so is vulnerable to denial of serviceDoS attack. The issue exists as an out-of-bounds access from the encoding function in libvncserver/corre.c...

SOS JobScheduler 1.13.3 CVE-2020-12712 Stored Password Decryption

SOS JobScheduler version 1.13.3 encrypts a secret by simply using the name of a profile as the key, making it trivial to decrypt. Exploit Title: SOS JobScheduler 1.13.3 - Stored Password Decryption Google Dork: N/A Date: 2020-04-20 Exploit Author: Sander Ubink Vendor Homepage: www.sos-berlin.com...