PYSEC-2020-244

OMERO.web before 5.6.3 optionally allows sensitive data elements e.g., a session key to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target...

jenkins: Diagnostic web page exposed Cookie HTTP header

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly...

EulerOS 2.0 SP3 : python-urllib3 (EulerOS-SA-2019-2239)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.CVE-2019-1123...

PT-2019-7873 · Ibm · Ibm Marketing Platform

Name of the Vulnerable Software and Affected Versions: IBM Marketing Platform versions 9.1.0 through 10.1 Description: The issue exposes sensitive information in the headers, which could be used by an authenticated attacker in further attacks against the system. Recommendations: For versions 9.1....

UBUNTU-CVE-2018-20060

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...

Requests package for Python information disclosure vulnerability

Requests package for Python is a Python-based open source HTTP library . A security vulnerability exists in Requests package for Python 2.19.1 and earlier versions released before 2018-09-14, which stems from a program that, when receiving a redirected request with the same hostname that converts...

MGASA-2016-0122 Updated moodle packages fix security vulnerability

In Moodle before 2.8.11, teachers who otherwise were not supposed to see students' emails could see them in the participants list CVE-2016-2151. In Moodle before 2.8.11, Moodle traditionally trusted content from external DB, however it was decided that external datasources may not be aware of web...

Scientific Linux Security Update : httpd on SL6.x i386/x86_64 (20120213)

The Apache HTTP Server is a popular web server. It was discovered that the fix for CVE-2011-3368 released in a previous update did not completely address the problem. An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly accessible to the attacker b...