320 matches found
CVE-2018-17192
The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on...
CVE-2018-17192
The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on...
Design/Logic Flaw
The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on...
RATELIMITED: Server Header disclose The Os and Web server Version
Server header was present and disclosed the version of the web server and OS in HTTP responses. Server header was present and disclosed the version of the web server and OS...
DEBIAN-CVE-2018-11652
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report...
GyoiThon - A Growing Penetration Test Tool Using Machine Learning
GyoiThon is a growing penetration test tool using Machine Learning. GyoiThon identifies the software installed on web server OS, Middleware, Framework, CMS, etc... based on the learning data. After that, it executes valid exploits for the identified software using Metasploit. Finally, it generate...
SickRage Information Disclosure Vulnerability
SickRage is an automated video manager for managing and storing TV programs. A security vulnerability exists in versions prior to SickRage v2018.03.09-1, which stems from an HTTP response containing credentials in plaintext form. An attacker could exploit the vulnerability to obtain information...
Hardcoded credentials
SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...
CVE-2018-9160
SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...
CVE-2018-9160
SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...
PYSEC-2018-101
SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...
CVE-2018-9160
SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses...
USN-3600-1: PHP vulnerabilities
It was discovered that PHP incorrectly handled certain stream metadata. A remote attacker could possibly use this issue to set arbitrary metadata. This issue only affected Ubuntu 14.04 LTS. CVE-2016-10712 It was discovered that PHP incorrectly handled the PHAR 404 error page. A remote attacker...
Information Disclosure
hadoop-common is vulnerable to information disclosure. The Jetty server version is leaked as a header in HTTP responses. Using this, attackers have a better idea of potential exploits which might work against the server...
CVE-2017-17968
A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response...
GNU Wget fd_read_body Heap Buffer Overflow (CVE-2017-13090)
A heap buffer overflow vulnerability exists in Wget. The vulnerability is due to improper handling of HTTP responses with chunked transfer encoding within the fdreadbody function. A remote, unauthenticated attacker could exploit this vulnerability by enticing a user to make an HTTP request to the...
USN-3464-1: Wget vulnerabilities
Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that Wget incorrectly handled certain HTTP responses. A remote attacker could use this issue to cause Wget to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2017-13089, CVE-2017-13090 Dawid Golunski...
Clickjacking Attacks
Hive HCatalog Webhcat is vulnerable to clickjacking attacks. The attacks exist due to the lack of the X-Frame-Options header in the HTTP responses sent by the web server...