GNOME libsoup Denial of Service Vulnerability

GNOME libsoup is an HTTP client/server library developed by the GNOME project. A security vulnerability exists in the soupcookiejargetcookies file in the soup-cookie-jar.c file in GNOME libsoup. An attacker can exploit this vulnerability to cause a denial of service with an empty hostname...

CVE-2018-12910

The getcookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname...

Design/Logic Flaw

The getcookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname...

DEBIAN-CVE-2018-12910

The getcookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname...

CVE-2018-12910

The getcookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname...

CVE-2018-12910

The getcookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname...

CVE-2018-12910

The getcookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname...

Hostname Determination Reporting

The script reports information on how the hostname of the target was determined. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

CVE-2018-8039

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty"java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol";'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old...

CVE-2018-8039

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty"java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol";'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old...

CVE-2018-8039

CVE-2018-8039: Apache CXF could allow a remote attacker to conduct a man‑in‑the‑middle attack due to TLS hostname verification not working when using com.sun.net.ssl. In CXF versions prior to 3.2.5 and 3.1.16 the exception is not properly propagated, leaving clients vulnerable. IBM/Oracle/Red Hat...

Hostname Verification Bypass

Apache CXF is vulnerable to hostname verification bypass. The vulnerability exists when CXF is used with the com.sun.net.ssl stack, leading to an error in TLS hostname verification which make CXF clients susceptible to man-in-the-middle attack...

CVE-2018-12910

The getcookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname...

UBUNTU-CVE-2018-12910

The getcookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname...

Apache CXF CVE-2018-8039 TLS Hostname Verification Security Bypass Vulnerability

Description Apache CXF is prone to a security-bypass vulnerability. Successfully exploiting this issue may allow attackers to obtain sensitive information by conducting a man-in-the-middle attack. This may lead to other attacks. The following versions of product are vulnerable: Apache CXF 3.1.16...

Apache CXF Authentication Bypass Vulnerability

Apache CXF is the United States Apache Apache Software Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs. A security vulnerability exists in Apache CXF versions prior to 3.2.5 and 3.1.16, which...

dns-sync Command Injection Vulnerability

dns-sync is a library used in Node.js that allows to resolve hostnames in a synchronized way. A security vulnerability exists in dns-sync. An attacker can exploit this vulnerability to inject commands with untrusted user input...

www/py-requests -- Information disclosure vulnerability

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network...

Pseudo-Shell Post-Exploitation Module

This module will run a Pseudo-Shell. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'readline' class MetasploitModule Msf::Post include Msf::Post::File include Msf::Post::Unix include Msf::Post::Linux::System...

Buffer overflow

Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h aka...