Cross-site Scripting (XSS)

ratpack-core is susceptible to cross-site scripting XSS. It does not sanitize the user input rendered as an exception message in the development error handler, allowing an attacker to inject malicious script via the message.The library is vulnerable only through the development mode's error handl...

Default development error handler in Ratpack is vulnerable to HTML content injection (XSS)

Versions of Ratpack from 0.9.10 through 1.7.5 are vulnerable to CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' aka. XSS in the development error handler. An attacker can utilize this to perform XSS when an exception message contains untrusted data. As a...

Information Disclosure

sylius/sylius is vulnerable to information disclosure. The vulnerability exists as the internal exception message gets exposed in the login action through the value of lasterror.message in Security/login.html.twig...

CVE-2019-16768

In affected versions of Sylius, exception messages from internal exceptions like database exception are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible...

CVE-2019-16768

CVE-2019-16768 affects Sylius: internal exception messages from login errors could leak system details to users. The root cause is exception messages from internal exceptions (e.g., database errors) being wrapped and surfaced in the UI via the login flow. Affected versions are fixed in Sylius rel...

python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py

Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...

CVE-2016-10773

cPanel before 60.0.25 allows format-string injection in exception-message handling SEC-171...

Format string

cPanel before 60.0.25 allows format-string injection in exception-message handling SEC-171...

CVE-2016-10773

cPanel before 60.0.25 allows format-string injection in exception-message handling SEC-171...

Apple iOS - Kernel Stack Memory Disclosure due to Failure to Check copyin Return Value

Here's a code snippet from sleh.c with the second level exception handler for undefined instruction exceptions: static void handleuncategorizedarmsavedstatet state, booleant instrLen2 exceptiontypet exception = EXCBADINSTRUCTION; machexceptiondatatypet codes2 = EXCARMUNDEFINED; machmsgtypenumbert...

Security update for python-python-gnupg (moderate)

This update for python-python-gnupg to version 0.4.3 fixes the following issues: The following security vulnerabilities were addressed: - Sanitize diagnostic output of the original file name in verbose mode CVE-2018-12020 boo1096745 The following other changes were made: - Add --no-verbose to the...

MGASA-2018-0040 Updated python-werkzeug packages fix security vulnerability

Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message CVE-2016-10516...

Debian DLA-1191-1 : python-werkzeug security update

A security issue that allows XSS on the Werkzeug debugger allows remote attackers to inject arbitrary stuff via a field that contains an exception message. For Debian 7 'Wheezy', these problems have been fixed in version 0.8.3+dfsg-1+deb7u1. We recommend that you upgrade your python-werkzeug...

USN-3463-1 python-werkzeug vulnerability

It was discovered that Werkzeug did not properly handle certain web scripts. A remote attacker could use this to inject arbitrary code via a field that contains an exception message...

USN-3463-1: Werkzeug vulnerability

It was discovered that Werkzeug did not properly handle certain web scripts. A remote attacker could use this to inject arbitrary code via a field that contains an exception message...

PYSEC-2017-43

Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...

Cross site scripting

Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...

CVE-2016-10516

Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...

Tor: Crashes/Buffer at 0x2C0086,name=PBrowser::Msg_Destroy

Hi Team, Steps to Reproduce: 1. Open Tor 2. Navigate to string.html Where string.html : function tor var uristring = unescape"%u4141%u4141"; fori=0; i 3. 'Gah! This tab has crashed. However, running it to debug mode generates the below exception : !!! ParentMessageChannel Error:...

Fedora 19 : mediawiki-1.21.2-1.fc19 (2013-15984)

SECURITY: Fix extension detection with 2 .'s - SECURITY: Support for the 'gettoken' parameter to action=block and action=unblock, deprecated since 1.20, has been removed. - SECURITY: Sanitize ResourceLoader exception messages - Purge upstream caches when deleting file assets. - Unit test suite...