5347 matches found
CVE-2020-0938
creationtimestamp| type| source ---|---|--- 2020-04-14 20:39:14+00:00| seen| https://t.me/thehackernews/668 2020-04-15 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=468 2020-04-15 08:24:17+00:00| published-proof-of-concept| https://t.me/cKure/288 2020-04-15 12:22:54+00:0...
python: CRLF injection via the query part of the url passed to urlopen()
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the query string after a ? charact...
AVLEONOV Podcast
I finally launched my own podcast. These are the audio tracks from my videos with some minimal changes, but it may be more convenient for someone to follow me this way. You can try to find my podcast in your podcast player by searching for "avleonov" well, at least it works in Podcast Addict or a...
cpp-httplib injection vulnerability
cpp-httplib is an HTTP/HTTPS server and client library written in C++. A security vulnerability exists in cpp-httplib version 0.5.8 and earlier, which stems from the program's failure to filter string-laden arguments passed to the 'setredirect' and 'setheader' functions. The vulnerability can be...
CVE-2020-0787
creationtimestamp| type| source ---|---|--- 2020-04-12 20:36:33+00:00| published-proof-of-concept| https://t.me/hybgl/146 2020-06-11 06:14:52+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve20200787bitsarbitraryfilemove.rb 2020-10-09...
UBUNTU-CVE-2020-11709
cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the setredirect and setheader functions, which creates possibilities for CRLF injection and HTTP response splitting in some specific contexts...
CVE-2020-3952
creationtimestamp| type| source ---|---|--- 2020-04-12 06:01:42+00:00| seen| https://t.me/informationsecuritychannel/36785 2020-04-13 15:30:02+00:00| seen| https://t.me/SecLabNews/7342 2020-04-16 09:08:53+00:00| published-proof-of-concept| https://t.me/techpwnews/434 2020-04-16 12:54:03+00:00|...
Error 0x800401f0 when you update RemoteApp and Desktop Connections feeds in Windows 7 or Windows Server 2008 R2
Error 0x800401f0 when you update RemoteApp and Desktop Connections feeds in Windows 7 or Windows Server 2008 R2 Symptoms Consider the following scenario: You have update 2857650 installed on a computer that is running Windows 7 Service Pack 1 SP1 or Windows Server 2008 R2 SP1. You subscribe to a...
haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return CR, ASCII 0xd, line feed LF, ASCII 0xa, and the zero character NUL, ASCII 0x0, aka Intermediary Encapsulation Attacks...
CVE-2020-11585
There is an information disclosure issue in DNN formerly DotNetNuke 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager other than ones contained in a secure folder by sending themselves a message...
CVE-2020-11585
There is an information disclosure issue in DNN formerly DotNetNuke 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager other than ones contained in a secure folder by sending themselves a message...
Information disclosure
There is an information disclosure issue in DNN formerly DotNetNuke 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager other than ones contained in a secure folder by sending themselves a message...
CVE-2020-11585
There is an information disclosure issue in DNN formerly DotNetNuke 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager other than ones contained in a secure folder by sending themselves a message...
MISP Information Disclosure Vulnerability (CNVD-2020-23173)
MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in the app/Model/feed.php file in versions of MISP prior t...
[SECURITY] [DSA 4650-1] qbittorrent security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4650-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 02, 2020 https://www.debian.org/security/faq -...
python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...
PT-2020-12610 · Phpmyadmin +2 · Phpmyadmin +2
Name of the Vulnerable Software and Affected Versions: phpMyAdmin version 5.0.2 Description: The issue allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. The vendor states that they do not see anything...
PayloadsAllTheThings
This repository is an offensive tool for API key and bucket S3 exploitation. It contains tools and exploits for various types of attacks, including CRLF injection, CSRF injection, and API key leaks. The repository includes a variety of scripts and modules for different types of attacks, such as...