UI REDRESSING

Description The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Proof of Concept Go to this URL:...

UI Redressing

Description The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Proof of Concept 1. Go to this URL:...

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service...

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service...

Rocket.Chat: Clickjacking at open.rocket.chat

The open.rocket.chat instance was found to have a misconfiguration issue with the "X-FRAME-OPTIONS" header, which could have allowed for clickjacking attacks. The issue was acknowledged and accepted by the Rocket.Chat team. However, they no longer accept vulnerability reports for their clients or...

org.jenkins-ci.main:jenkins-test-harness (1.429), org.jenkins-ci.main:jenkins-war (1.429) +8 more potentially affected by CVE-2019-10404 via org.jenkins-ci.main:jenkins-core (1.429)

org.jenkins-ci.main:jenkins-core MAVEN version 1.429 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.429 - org.jenkins-ci.main:jenkins-war 1.429 -...

DEBIAN-CVE-2021-3597

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to...

CVE-2021-3597

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to...

org.jenkins-ci.main:jenkins-test-harness (1.429), org.jenkins-ci.main:jenkins-war (1.429) +8 more potentially affected by CVE-2021-21610 via org.jenkins-ci.main:jenkins-core (1.429)

org.jenkins-ci.main:jenkins-core MAVEN version 1.429 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.429 - org.jenkins-ci.main:jenkins-war 1.429 -...

org.jenkins-ci.main:jenkins-test-harness (1.429), org.jenkins-ci.main:jenkins-war (1.429) +8 more potentially affected by CVE-2021-21604 via org.jenkins-ci.main:jenkins-core (1.429)

org.jenkins-ci.main:jenkins-core MAVEN version 1.429 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.429 - org.jenkins-ci.main:jenkins-war 1.429 -...

org.jenkins-ci.main:jenkins-test-harness (1.429), org.jenkins-ci.main:jenkins-war (1.429) +8 more potentially affected by CVE-2020-2220 via org.jenkins-ci.main:jenkins-core (1.429)

org.jenkins-ci.main:jenkins-core MAVEN version 1.429 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.429 - org.jenkins-ci.main:jenkins-war 1.429 -...

org.jenkins-ci.main:jenkins-test-harness (1.429), org.jenkins-ci.main:jenkins-war (1.429) +8 more potentially affected by CVE-2020-2162 via org.jenkins-ci.main:jenkins-core (1.429)

org.jenkins-ci.main:jenkins-core MAVEN version 1.429 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.429 - org.jenkins-ci.main:jenkins-war 1.429 -...

GHSA-7XP8-7WQX-5HQX Jenkins REST APIs vulnerable to clickjacking

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not serve the X-Frame-Options: deny HTTP header on REST API responses to protect against clickjacking attacks. An attacker could exploit this by routing the victim through a specially crafted web page that embeds a REST API endpoint in an...

Jenkins REST APIs vulnerable to clickjacking

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not serve the X-Frame-Options: deny HTTP header on REST API responses to protect against clickjacking attacks. An attacker could exploit this by routing the victim through a specially crafted web page that embeds a REST API endpoint in an...

org.jenkins-ci.main:jenkins-test-harness (1.429), org.jenkins-ci.main:jenkins-war (1.429) +8 more potentially affected by CVE-2019-10352 via org.jenkins-ci.main:jenkins-core (1.429)

org.jenkins-ci.main:jenkins-core MAVEN version 1.429 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.429 - org.jenkins-ci.main:jenkins-war 1.429 -...

PT-2022-10483 · Undertow · Undertow

Name of the Vulnerable Software and Affected Versions: Undertow versions prior to 2.0.35.SP1 Undertow versions prior to 2.0.36.SP1 Undertow versions prior to 2.0.39.Final Undertow versions prior to 2.2.6.SP1 Undertow versions prior to 2.2.7.SP1 Undertow versions prior to 2.2.9.Final Description: ...

Firefox ESR Thunderbird Isolated iframe Bypass

The vulnerability in the isolated iframe environment of Firefox web browsers, Firefox ESR, and the Thunderbird email client is related to an incorrect limitation on the number of visible layers or frames. Exploiting this vulnerability allows a malicious actor to bypass existing security...

UI REDRESSING

Description The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Proof of Concept Go to this URL:...

UI REDRESSING

Description The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Proof of Concept Go to this URL:...

DEBIAN-CVE-2022-29023

A buffer overflow vulnerability exists in the razermouse driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service DoS and possibly escalate their privileges via a crafted buffer sent to the matrixcustomframe device...