PT-2019-7828

Name of the Vulnerable Software and Affected Versions iOS versions prior to 9.3.3 tvOS versions prior to 9.2.2 OS X El Capitan versions prior to 10.11.6 and Security Update 2016-004 Description A downgrade issue existed with HTTP authentication credentials saved in Keychain. This issue was...

aria2 1.33.1 Password Disclosure

Exploit Title: Metadata and potential password leak in aria2 Date: 2019-01-02 Exploit Author: Dhiraj Mishra Software Link: https://github.com/aria2/aria2 Version: aria2 1.33.1 Tested on: Linux 4.15.0-38-generic CVE: CVE-2019-3500 Summary aria2 is a lightweight multi-protocol command-line utility,...

SUSE-SU-2018:4215-1 Security update for enigmail

This update for enigmail to version 2.0.9 fixes the following issues: Security issue fixed: - When using Web Key Discovery, a HTTP authentication may be triggered. This may trick users into possibly sending e-mail credentials bsc1118935. Non-security issues fixed: - pEp - PGP/MIME signed-only...

PT-2018-19239

Name of the Vulnerable Software and Affected Versions Enigmail versions prior to 2.0.9 Description A security issue is fixed where using Web Key Discovery may trigger an HTTP authentication, potentially tricking users into sending email credentials. Recommendations For Enigmail versions prior to...

CVE-2018-18353

Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page...

Scientific Linux Security Update : curl and nss-pem on SL7.x x86_64 (20181030)

Security Fixes : - curl: HTTP authentication leak in redirects CVE-2018-1000007 - curl: FTP path trickery leads to NIL byte out of bounds write CVE-2018-1000120 - curl: RTSP RTP buffer over-read CVE-2018-1000122 - curl: Out-of-bounds heap read when missing RTSP headers allows information leak of...

RHEL 7 : curl and nss-pem (RHSA-2018:3157)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3157 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTT...

.NET Core Information Disclosure Vulnerability (Oct 2018) - Windows

.NET Core is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft PowerShell Core Information Disclosure Vulnerability (Oct 2018) - Linux

This host is missing an important security update for PowerShell Core according to Microsoft security advisory CVE-2018-8292. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Microsoft PowerShell Core Information Disclosure Vulnerability (Oct 2018) - Windows

This host is missing an important security update for PowerShell Core according to Microsoft security advisory CVE-2018-8292. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Microsoft PowerShell Core Information Disclosure Vulnerability (Oct 2018) - Mac OS X

This host is missing an important security update for PowerShell Core according to Microsoft security advisory CVE-2018-8292. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2018-5115

If an HTTP authentication prompt is triggered by a background network request from a page or extension, it is displayed over the currently loaded foreground page. Although the prompt contains the real domain making the request, this can result in user confusion about the originating site of the...

CVE-2018-5115

If an HTTP authentication prompt is triggered by a background network request from a page or extension, it is displayed over the currently loaded foreground page. Although the prompt contains the real domain making the request, this can result in user confusion about the originating site of the...

CVE-2018-5115

CVE-2018-5115 is a vulnerability in Firefox prior to version 58 where an HTTP authentication prompt triggered by a background network request can be displayed over the current foreground page, potentially confusing users about the request origin and leading them to submit credentials to a third p...

CVE-2018-5115: Exposure of Sensitive Information to an Unauthorized Actor

If an HTTP authentication prompt is triggered by a background network request from a page or extension, it is displayed over the currently loaded foreground page. Although the prompt contains the real domain making the request, this can result in user confusion about the originating site of the...

Mail.ru: Stored XSS in api.icq.net

Crossite scripting in api.icq.net domain. icq.net is considered as a sandbox domain, it does not use HTTP authentication or cookies, but XSS could be used to facilitate phishing attack...

JCS - Joomla Vulnerability Component Scanner

JCS Joomla Component Scanner made for penetration testing purpose on Joomla CMS JCS can help you with the latest component vulnerabilities and exploits. The database can update from several resources and a Crawler has been implemented to find components and component's link. This version supports...

Amazon Linux 2 : curl (ALAS-2018-951)

HTTP authentication leak in redirects libcurl might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP...

Western Digital My Cloud Pro Series PR2100 Authenticated RCE

Vulnerability Summary A vulnerability in the Western Digital My Cloud Pro Series PR2100 allows authenticated users to execute commands arbitrary commands. Credit An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program. Vendor...

OpenJDK: use of global credentials for HTTP/SPNEGO (JGSS, 8186600)

The JGSS component of OpenJDK ignores the value of the javax.security.auth.useSubjectCredsOnly property when using HTTP/SPNEGO authentication and always uses global credentials. It was discovered that this could cause global credentials to be unexpectedly used by an untrusted Java application...