CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

152 matches found

Snyk•added 2020/03/10 4:51 p.m.•1 views

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie. Remediation Upgrade...

8.8CVSS6.8AI score0.00653EPSS

SaveExploits0References2

OSV•added 2019/04/22 11:29 a.m.•11 views

CVE-2019-11447

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content ...

8.8CVSS7.3AI score0.52272EPSS

SaveExploits12References3

RedHat Linux•added 2019/04/10 8:29 p.m.•8 views

istio/envoy: Authorization bypass via null characters injection in HTTP/1.x

A flaw was found in Envoy version 1.9.0 and older, where Envoy does not reject embedded zero characters NUL, ASCII 0x0 when processing HTTP/1.x header values. This flaw allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules,...

8.3CVSS5.8AI score0.03732EPSS

SaveExploits1References4

zdt•added 2019/03/10 12:00 a.m.•219 views

McAfee ePO 5.9.1 - Registered Executable Local Access Bypass Vulnerability

Exploit for windows platform in category web applications Exploit Title: McAfee ePO 5.9.1 Registered Executable Local Access Bypass Exploit Author: @leonjza Vendor Homepage: https://www.mcafee.com/ Software Link: https://www.mcafee.com/enterprise/en-us/products/epolicy-orchestrator.html Version:...

4CVSS5.6AI score0.02583EPSS

SaveExploits4

UbuntuCve•added 2018/03/14 12:00 a.m.•26 views

CVE-2018-5131

Under certain circumstances the "fetch" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instead of downloading a copy from the network as it should. This can result in previously stored, locally cached data of a website being accessib...

5.9CVSS6.9AI score0.02293EPSS

SaveExploits0References3

CVE•added 2017/11/16 10:00 p.m.•59 views

CVE-2017-11038

CVE-2017-11038 is a Qualcomm memory-subsystem Elevation of Privilege flaw affecting Android on MSM devices (and CAF-based kernels) where, during boot image header processing, range checks can be bypassed by supplying different header versions. This enables possible local privilege escalation. The...

7.8CVSS7.1AI score0.00139EPSS

SaveExploits0References1Affected Software1

OpenVAS•added 2016/10/27 12:00 a.m.•51 views

Cisco Email Security Appliance MIME Header Bypass Vulnerability

A vulnerability in the email message and content filtering for malformed Multipurpose Internet Mail Extensions MIME headers of Cisco AsyncOS Software for Cisco Email Security Appliances ESA and Web Security Appliances WSA could allow an unauthenticated, remote attacker to bypass the filtering...

7.5CVSS7.7AI score0.01634EPSS

SaveExploits0References1

CNVD•added 2016/05/12 12:00 a.m.•10 views

Squid Security Bypass Vulnerability (CNVD-2016-03061)

Squid full name Squid Cache is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security bypass vulnerability exists in the mimeheader.cc file in versions of Squid prior to...

8.6CVSS7.6AI score0.38893EPSS

SaveExploits0References1

RedHat Linux•added 2015/11/25 9:15 p.m.•10 views