Cross-Site Scripting (XSS)

dolibarr is susceptible to cross-site scripting XSS attacks. The vulnerability exists due to the unsanitized value of the Referer HTTP header before being used into the HTML document allows an attacker to inject arbitrary script...

Information Disclosure

sylius/resource-bundle is vulnerable to information disclosure. The vulnerability exists as ResourceBundle did not properly restrict the values of serializationgroups to be passed through the HTTP header...

CVE-2020-5220

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...

CVE-2020-5220

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...

Design/Logic Flaw

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...

CVE-2020-5220

Sylius ResourceBundle has a vulnerability where it accepts and uses any serialization groups via an HTTP header, potentially exposing data by using an unintended serialization group (e.g., a permissive group from Admin API in Shop API). Affected products are Sylius ResourceBundle components, with...

CVE-2020-5220 Ability to expose data in Sylius by using an unintended serialisation group

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...

CVE-2020-7996

htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header...

CVE-2020-7996

htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header...

CVE-2020-7996

htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header...

Design/Logic Flaw

htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header...

CVE-2020-7996

Dolibarr ERP/CRM version 10.0.6 contains a cross-site scripting (XSS) flaw in htdocs/user/passwordforgotten.php that can be triggered via the Referer HTTP header. The available sources consistently describe this vulnerability as an XSS issue in the Referer header handling, with no publicly docume...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2019-2593)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerability

The Cisco Content Security Management Appliance SMA and the Cisco Web Security Appliance WSA are both products of Cisco, Inc.The Cisco Web Security Appliance is a Web security appliance. The appliance provides SaaS-based access control, real-time network reporting and tracking, and the developmen...

Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerability

A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance WSA and Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to inject crafted HTTP headers in the web server's response. The vulnerability is due to insufficient...

Amazon Linux 2 : golang, --advisory ALAS2-2020-1383 (ALAS-2020-1383)

The version of golang installed on the remote host is prior to 1.13.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1383 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C...

openSUSE: Security Advisory for python (openSUSE-SU-2019:2393-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-5846

The CVE-2020-5846 issue affects Ahsay Cloud Backup Suite 8.3.0.30. It describes an insecure file upload via PUT /obs/obm7/file/upload, where a base64-encoded pathname is supplied in the X-RSW-custom-encode-path header and the file contents in the request body. This allows uploading a file into an...

F5 Networks BIG-IP : TMM vulnerability (K23860356)

iRules performing HTTP header manipulation may cause a denial-of-serviceDoS when processing traffic handled by a virtual server with an associated HTTP profile, in specific circumstances, when the requests do not strictly conform to RFCs.CVE-2019-6660 Impact The affected BIG-IP system's Traffic...

Design/Logic Flaw

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server...