The vulnerability of the eDocLib platform for storing and processing corporate data lies in the absence of a user-friendly error page, which allows attackers to disclose the protected information.

The vulnerability of the eDocLib platform for storing and processing corporate data exists due to an error in the application configuration, which results in the absence of a user-friendly error page. Exploiting this vulnerability allows a malicious actor to disclose system-sensitive information ...

Apache Httpd < 2.4.41 : Limited cross-site scripting in mod_proxy error page

A limited cross-site scripting issue was reported affecting the modproxy error page. An attacker could cause the link on the error page to be malfomed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured ...

Cross-site Scripting (XSS)

PHP is vulnerable to cross-site scripting attacks. A remote unauthenticated attacker could cause reflected cross-site scripting on the PHAR 404 error page via the URI of a request for a .phar file...

Seagate NAS OS Cross-Site Scripting Vulnerability

Seagate NAS OS is a NAS Network Attached Storage operating system from Seagate USA. A cross-site scripting vulnerability exists in the API error page in Seagate NAS OS version 4.3.15.1. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker cou...

Apache Tomcat 8.5.x < 8.5.15 Remote Error Page Manipulation

Binary data 700690.pasl...

Information Disclosure

jetty-server is vulnerable to information disclosure. The error page produced from DefaultHandler reveals the base resource directory of each context in the list of contexts...

DEBIAN-CVE-2019-10247

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches...

Design/Logic Flaw

Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL...

The vulnerability of the Taserver web service on the TeNIX operating system for programmable logic controllers MFC1500 and MFC3000 allows a perpetrator to execute arbitrary code.

The vulnerability of the TAserver web service for the TeNIX programmable logic controllers MFC1500 and MFC3000 lies in the lack of name filtering when generating a 404 HTTP error page. As a result, the name of the non-existent web page is passed unchanged to the generated error page. Exploiting...

CVE-2019-3498

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound, leading to content spoofing in a 404 error page if a user fails to recognize th...

CFP Time: Content spoofing on error pages or text injection

Poc: https://www.cfptime.org/%20is%20not%20available%20anymore%20,%20pls%20go%20to%20WWW.EVIL.COM%20because%20this%20site. Steps to reproduce: 1: Just browse this target on any browser 2: Target: http://www.cfptime.org/ 3: add any content after For example: this is not available anymore pls check...

GitLab: information disclosure of secret_key_base via encoding charcters

@pareshparmar discovered an error page that was disclosing the value of the secretkeybase key of customers.gitlab.com to unauthenticated users, which would have allowed an attacker to arbitrarily decrypt signed cookies. So I was fuzzing one parameter with different type of encodings. And one...

Squid Cross-Site Scripting Vulnerability

Squid is a caching and forwarding HTTP web proxy. A cross-site scripting vulnerability exists in Squid prior to 4.4, which can be exploited by an attacker via a specially crafted X.509 certificate during HTTPS error page generation with a certificate error...

CVE-2018-19131

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...

DEBIAN-CVE-2018-19131

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...

CVE-2018-19131

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...

CVE-2018-19131

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...

Design/Logic Flaw

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...

CVE-2018-19131

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...

CVE-2018-19131

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...