5347 matches found
The vulnerability of the Google Chrome browser arises from its inability to handle sequences of characters CRLF, which allows attackers to circumvent navigation restrictions.
The vulnerability of the Google Chrome browser exists due to the failure to address the issue of eliminating CRLF sequences. Exploiting this vulnerability allows a remote attacker to circumvent navigation restrictions by using a specially created HTML page...
Armeria Injection Vulnerability
Armeria is an open source library for building asynchronous microservers that use HTTP/2 as the session layer protocol. Armeria suffers from an injection vulnerability. The vulnerability stems from a lack of proper validation of user input data by a network system or product during the course of ...
DEBIAN-CVE-2019-19330
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return CR, ASCII 0xd, line feed LF, ASCII 0xa, and the zero character NUL, ASCII 0x0, aka Intermediary Encapsulation Attacks...
UBUNTU-CVE-2019-19330
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return CR, ASCII 0xd, line feed LF, ASCII 0xa, and the zero character NUL, ASCII 0x0, aka Intermediary Encapsulation Attacks...
The vulnerability of the WEBrick library for the Ruby programming language allows attackers to inject arbitrary HTTP headers.
The vulnerability of the WEBrick library for the Ruby programming language interpreter is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTTP headers remotely...
DEBIAN-CVE-2010-3438
libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the client to disconnect from the server...
Open Redirect Bug in Bridge Theme Plugin Opens Admins to Spearphishing
Two open-redirect vulnerabilities in Bridge, a commercial WordPress theme purchased more than 120,000 times, would allow an attacker to mount spearphishing attacks against site administrators. An open redirect vulnerability can be used to hide malicious links behind URLs for legitimate domains. F...
CVE-2009-2937
Cross-site scripting XSS vulnerability in Planet 2.0 and Planet Venus allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IMG element in a feed...
HTTP response splitting in WEBrick (Additional fix)
If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This is the same issue as CVE-2017-17742. The previous fix was incomplete, which addressed the...
CVE-2019-1367
creationtimestamp| type| source ---|---|--- 2019-09-23 20:31:14+00:00| seen| https://t.me/ctinow/15985 2019-09-24 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=421 2019-09-24 09:51:37+00:00| seen| https://t.me/thehackernews/473 2019-09-24 09:55:12+00:00| exploited|...
CVE-2019-5993
Cross-site request forgery CSRF vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-5993
Cross-site request forgery CSRF vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-5993
Cross-site request forgery CSRF vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-5993
CVE-2019-5993 applies to the WordPress plugin Category Specific RSS feed Subscription, vulnerable to cross-site request forgery (CSRF) in versions v2.0 and earlier. The underlying issue allows an attacker to hijack administrator actions when a logged-in user visits a malicious page. Affected comp...
WordPress WP Social Feed Gallery Plugin < 2.4.8 Authentication Bypass Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.113508";...
WordPress Social LikeBox & Feed Plugin < 2.8.5 CSRF Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.113510";...
feed-maker.de Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-959842 Security Researcher k1ssn00b Helped patch 9 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting feed-maker.de website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO...
Magento RSS Feed Brute Force
Magento authenticated RSS Feed has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...
WordPress Plugin WooCommerce Product Feed 2.2.18 - Cross-Site Scripting
WordPress Plugin WooCommerce Product Feed 2.2.18 - Cross-Site Scripting Exploit Title: WordPress Plugin WooCommerce Product Feed = 2.2.18 - Cross-Site Scripting Date: 30 August 2019 Exploit Author: Damian Ebelties https://zerodays.lol/ Vendor Homepage:...