943 matches found
Seagate NAS OS Cross-Site Scripting Vulnerability
Seagate NAS OS is a NAS Network Attached Storage operating system from Seagate USA. A cross-site scripting vulnerability exists in the API error page in Seagate NAS OS version 4.3.15.1. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker cou...
Apache Tomcat 8.5.x < 8.5.15 Remote Error Page Manipulation
Binary data 700690.pasl...
Information Disclosure
jetty-server is vulnerable to information disclosure. The error page produced from DefaultHandler reveals the base resource directory of each context in the list of contexts...
DEBIAN-CVE-2019-10247
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches...
Design/Logic Flaw
Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL...
The vulnerability of the Taserver web service on the TeNIX operating system for programmable logic controllers MFC1500 and MFC3000 allows a perpetrator to execute arbitrary code.
The vulnerability of the TAserver web service for the TeNIX programmable logic controllers MFC1500 and MFC3000 lies in the lack of name filtering when generating a 404 HTTP error page. As a result, the name of the non-existent web page is passed unchanged to the generated error page. Exploiting...
CVE-2019-3498
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound, leading to content spoofing in a 404 error page if a user fails to recognize th...
CFP Time: Content spoofing on error pages or text injection
Poc: https://www.cfptime.org/%20is%20not%20available%20anymore%20,%20pls%20go%20to%20WWW.EVIL.COM%20because%20this%20site. Steps to reproduce: 1: Just browse this target on any browser 2: Target: http://www.cfptime.org/ 3: add any content after For example: this is not available anymore pls check...
GitLab: information disclosure of secret_key_base via encoding charcters
@pareshparmar discovered an error page that was disclosing the value of the secretkeybase key of customers.gitlab.com to unauthenticated users, which would have allowed an attacker to arbitrarily decrypt signed cookies. So I was fuzzing one parameter with different type of encodings. And one...
Squid Cross-Site Scripting Vulnerability
Squid is a caching and forwarding HTTP web proxy. A cross-site scripting vulnerability exists in Squid prior to 4.4, which can be exploited by an attacker via a specially crafted X.509 certificate during HTTPS error page generation with a certificate error...
CVE-2018-19131
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...
CVE-2018-19131
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...
DEBIAN-CVE-2018-19131
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...
Design/Logic Flaw
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...
CVE-2018-19131
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...
CVE-2018-19131
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...
CVE-2018-19131
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...
CVE-2018-19131
CVE-2018-19131 affects Squid prior to 4.4, enabling cross-site scripting via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors. Connected advisories confirm the issue and provide fixes: Amazon Linux 2 ALAS2-2023-2310 lists updated squid packages (e.g., squid-...
CVE-2018-19131
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors. Recent assessments: travisbgreen at April 21, 2020 10:49pm UTC reported: Bottom line: The commonName property of the certificate that signs the “failed to connect securely” error pa...
Apache Tomcat 7.0.x < 7.0.78 Remote Error Page Manipulation
According to its self-reported version number, the Apache Tomcat service running on the remote host is 7.0.x prior to 7.0.78 or 8.5.x prior to 8.5.15. It is, therefore, affected by an implementation flaw in the error page reporting mechanism in which it does not conform to the Java Servlet...