PT-2020-21358

Name of the Vulnerable Software and Affected Versions dictum.js version 1.0.5 Description The issue concerns malicious code in version 1.0.5 of dictum.js, which when executed in a browser, can enumerate fields such as password, cvc, and cardnumber from forms. The extracted values are then sent to...

PT-2020-21232

Name of the Vulnerable Software and Affected Versions @impala/bmap version 1.0.3 Description The issue concerns malicious code in version 1.0.3 of the @impala/bmap module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends...

PT-2020-21524

Name of the Vulnerable Software and Affected Versions dynamo-schema version 0.0.3 Description The issue concerns malicious code in version 0.0.3 of the dynamo-schema module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and send...

PT-2020-21186

Name of the Vulnerable Software and Affected Versions modlibrary version 0.1.1 Description The issue concerns malicious code in version 0.1.1 of the modlibrary module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the...

PT-2020-21185

Name of the Vulnerable Software and Affected Versions impala version 1.1.7 Description The issue concerns malicious code in a specific version of the software, which, when executed in a browser, can extract sensitive information such as password, cvc, and cardnumber fields from forms. This...

PT-2020-21044

Name of the Vulnerable Software and Affected Versions xoc version 1.0.7 Description The issue concerns malicious code in version 1.0.7 of the xoc module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the extracted valu...

Cookies Collected

The scanner collected the cookies returned by the application during the scan. The list includes the following information for each cookie: - Name: name of the cookie - Value: value of the cookie - Domain: hosts to which the cookie will be sent - Path: URL path which must exist in the requested...

JVN#06446084: CLUSTERPRO X and EXPRESSCLUSTER X vulnerable to XML external entity injection (XXE)

CLUSTERPRO X and EXPRESSCLUSTER X provided by NEC Corporation contain an XML external entity injection XXE vulnerability CWE-611. Impact By reading a specially crafted XML files, an arbitrary file on the server may be read by the attacker. Solution Update the Software The following updates are...

CVE-2020-25019

jitsi-meet-electron aka Jitsi Meet Electron before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances...

Squid 2.x < 4.13 / 5.x < 5.0.4 (SQUID-2020:8 and SQUID-2020:10)

According to its banner, the version of Squid running on the remote host is 2.x prior to 4.13 or 5.x prior to 5.0.4. It is,therefore, affected by multiple vulnerabilities: - An input-validation flaw exists related to handling HTTP and HTTPS traffic that allows HTTP request splitting leading to...

Fedora: Security Advisory for curl (FEDORA-2020-da832cb434)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-15810

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the...

CVE-2020-15811

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the...

Denial of Service in https-proxy-agent

Withdrawn: Duplicate of GHSA-8g7p-74h8-hg48...

GHSA-QRG3-F6H6-VQ8Q Denial of Service in https-proxy-agent

Withdrawn: Duplicate of GHSA-8g7p-74h8-hg48...

Phantom-Evasion

This is a Python antivirus evasion tool called Phantom-Evasion. It is free software, licensed under the GNU General Public License GPL version 3. The tool is designed to evade detection by antivirus software and is intended for educational or research purposes only. The tool consists of several...

HTTP/HTTPS proxy support on NetScaler based on Traffic Policies Secure Web

This article describes how to configure NetScaler to proxy the traffic from MDX apps through a Proxy server like Squid, Bluecoat. Enterprises can proxy traffic configuring simple traffic rules on NetScaler box...

Man-in-the-Middle (MitM)

jangaroo-parent is vulnerable to man-in-the-middle MitM. The vulnerability exists as its dependencies are resolved over HTTP instead of HTTPS...

r-2.sns.gov.pt Improper Access Control vulnerability OBB-1257192

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Acronis: Subdomain Takeover – www.jet.acronis.com pointing to unclaimed Webflow services

Hi Team, Greetings! I've come across another subdomainwww.jet.acronis.com of acronis.com pointing to an unclaimed Webflow service. Visiting the www.jet.acronis.com returned the default 404 page for Webflow service, thereby making it potential for subdomain takeover. F940499 Similar to the previou...