107 matches found
CURL-CVE-2020-8177 curl overwrite local file with -J
curl can be tricked by a malicious server to overwrite a local file when using -J --remote-header-name and -i --include in the same command line. The command line tool offers the -J option that saves a remote file using the filename present in the Content-Disposition: response header. curl then...
PT-2020-3018
Name of the Vulnerable Software and Affected Versions curl versions 7.20.0 through 7.70.0 Description The issue exists due to a logical error in handling the Content-Disposition header of an HTTP response. This can allow a remote attacker to overwrite a local file. The vulnerability is related to...
HTTP/2: 0-length headers lead to denial of service
A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially...
Cross-site Scripting (XSS)
umbraco cms is vulnerable to cross-site scripting. A remotely authenticated attacker is able to inject arbitrary Javascript into a victim's browser via the Header Name when updating or removing public access of content...
CVE-2018-17256
Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...
CVE-2018-17256
CVE-2018-17256 concerns a stored XSS vulnerability in Umbraco CMS 7.12.3 . The issue allows an authenticated user to inject arbitrary web script via the Header Name field of a content item (e.g., Blog, Content Page) and is triggered when updating or removing public access to content. Connected do...
CVE-2018-17256
Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...
Cross site scripting
Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...
CVE-2018-17256
Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...
CVE-2018-17256
Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...
PT-2018-13969
Name of the Vulnerable Software and Affected Versions Umbraco CMS version 7.12.3 Description A persistent cross-site scripting XSS issue allows authenticated users to inject arbitrary web script via the Header Name of a content, such as a Blog or Content Page. This issue is exploited when updatin...
CVE-2018-17256: Improper Neutralization of Input During Web Page Generation
Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...
CVE-2017-7797
Response header name interning does not have same-origin protections and these headers are stored in a global registry. This allows stored header names to be available cross-origin. This vulnerability affects Firefox 55...
CVE-2017-7797
CVE-2017-7797 affects Firefox versions prior to 55.0. The issue arises from how response header names are interned: header names are stored in a global registry and are not protected by same-origin policies, allowing stored header names to be exposed across origins. Public documentation in the co...
CVE-2017-7797: Origin Validation Error
Response header name interning does not have same-origin protections and these headers are stored in a global registry. This allows stored header names to be available cross-origin. This vulnerability affects Firefox 55...
PT-2018-6034
Name of the Vulnerable Software and Affected Versions: http-signature versions =0.9.11 Description: The issue allows an attacker in a privileged network position to modify header names and change the meaning of the request without requiring an updated signature. This occurs because vulnerable...
UBUNTU-CVE-2017-7797
Response header name interning does not have same-origin protections and these headers are stored in a global registry. This allows stored header names to be available cross-origin. This vulnerability affects Firefox 55...
PT-2017-4017
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 55 Description The issue is related to the lack of same-origin protections for response header name interning, allowing stored header names to be available cross-origin. This could potentially enable a remote attacker...
PT-2016-4402
Name of the Vulnerable Software and Affected Versions cURL versions prior to 7.47.0 Description The issue allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name. This is because cURL does not sanitize colons in a remote...
