CVE-2018-19131

CVE-2018-19131 affects Squid prior to 4.4, enabling cross-site scripting via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors. Connected advisories confirm the issue and provide fixes: Amazon Linux 2 ALAS2-2023-2310 lists updated squid packages (e.g., squid-...

CVE-2018-19131

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors. Recent assessments: travisbgreen at April 21, 2020 10:49pm UTC reported: Bottom line: The commonName property of the certificate that signs the “failed to connect securely” error pa...

Apache Tomcat 7.0.x < 7.0.78 Remote Error Page Manipulation

According to its self-reported version number, the Apache Tomcat service running on the remote host is 7.0.x prior to 7.0.78 or 8.5.x prior to 8.5.15. It is, therefore, affected by an implementation flaw in the error page reporting mechanism in which it does not conform to the Java Servlet...

Apache Tomcat 8.5.x < 8.5.15 Remote Error Page Manipulation

According to its self-reported version number, the Apache Tomcat service running on the remote host is 7.0.x prior to 7.0.78 or 8.5.x prior to 8.5.15. It is, therefore, affected by an implementation flaw in the error page reporting mechanism in which it does not conform to the Java Servlet...

GHSA-QW96-MM2G-C8M7 Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /error page...

Cross-site Scripting (XSS)

next is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the pathname variable, which allows a malicious user to inject and execute arbitrary Javascript through an error page such as a 404 or 500 error page...

CVE-2017-15420

CVE-2017-15420 describes a URL spoofing issue in Google Chrome/Chromium’s Omnibox caused by incorrect handling of back navigations on error pages, allowing a crafted HTML page to spoof the URL bar. Affected products/versions: Chrome prior to 63.0.3239.84 (per the CVE description). Remediation: up...

Apache HTTP Server Error Page Detection

Binary data apachehttperrorpagedetect.nbin...

SUSE-SU-2018:1847-1 Security update for tomcat6

This update for tomcat6 fixes the following security issues: - : The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This mean...

Security Bulletin: A security vulnerability has been identified in WebSphere Liberty Profile shipped with IBM Secutity Identity Governance and Intelligence (CVE-2016-0378 )

Summary There is a potential information disclosure in WebSphere Liberty Profile, shipped as a component of IBM Secutity Identity Governance and Intelligence. Vulnerability Details CVEID: CVE-2016-0378 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain...

Security Bulletin: Information Disclosure in IBM WebSphere Application Server Liberty (CVE-2016-0378)

Summary There is an Information Disclosure Vulnerability in IBM WebSphere Application Server Liberty. Vulnerability Details CVEID: CVE-2016-0378 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by improper handling of...

CVE-2017-18286

nZEDb v0.7.3.3 has XSS in the 404 error page...

CVE-2017-18286

nZEDb v0.7.3.3 has XSS in the 404 error page...

CVE-2017-18286

nZEDb v0.7.3.3 has XSS in the 404 error page...

CVE-2017-18286

CVE-2017-18286 affects nZEDb v0.7.3.3, with a Cross‑Site Scripting (XSS) flaw on the 404 error page caused by inadequate input filtering in the 404 page rendering. This can allow an attacker to inject arbitrary script in the victim’s browser through the URL. Several sources corroborate the XSS is...

nZEDb Cross-Site Scripting Vulnerability

nZEDb is a set of open source usenet news network indexer , it provides a Web-based front-end , support for searching , browsing usenet . A cross-site scripting vulnerability exists in the 404 error page in version 0.7.3.3 of nZEDb, which stems from the program failing to adequately filter input....

CVE-2018-11581

Cross-site scripting XSS vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html...

ILIAS Cross-Site Scripting Vulnerability (CNVD-2018-10349)

ILIAS is a Web-based learning management system developed by the ILIAS team. The system contains modules for course management, file sharing, and live chat. A cross-site scripting vulnerability exists in the error.php page in versions 5.3.x prior to ILIAS 5.3.4 and 5.2.x. A remote attacker can...

Vaultize Enterprise File Sharing Cross-Site Scripting Vulnerability (CNVD-2018-08540)

Vaultize Enterprise File Sharing is an enterprise file sharing solution from Vaultize Technologies, USA. The solution includes features such as data retention management, versioning, secure data handling, data backup and recovery. A cross-site scripting vulnerability exists in the error page in...

CVE-2018-10208

An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is anonymous reflected XSS on the error page via a /share/error?message= URI...