5631 matches found
SUSE CVE-2023-0472
Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2023-21805
Windows MSHTML Platform Remote Code Execution Vulnerability...
COMFAST CF-WR6110N: Input validation error vulnerability
The COMFAST CF-WR6110N is a wireless router from China Four Seas Zonglian COMFAST. A security vulnerability exists in COMFAST CF-WR6110N version V2.3.1, which originates from incorrect input validation and allows remote attackers on the same network to execute arbitrary code on the target via an...
DevTools Google Chrome Unauthorized Access
The vulnerability of the DevTools set of tools for web development in the Google Chrome web browser is related to type conversion errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created HTML page...
Cisco Small Business Router Command Execution
The vulnerability of the web interface for managing microprogrammed software routers from Cisco, such as Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325, is related to insufficient validation of input data during HTTP packet processing. Exploiting this vulnerability allows a...
varnish: Request Forgery Vulnerability
An HTTP Request Forgery issue was discovered in Varnish Cache. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could be used to exploit...
DEBIAN-CVE-2023-0700
Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...
DEBIAN-CVE-2023-0698
Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: High...
UBUNTU-CVE-2023-0699
Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page and browser shutdown. Chromium security severity: Medium...
Softr cross-site scripting vulnerabilities
Softr is a no-code website builder from Softr, Inc. A security vulnerability exists in Softr version v2.0, which stems from the presence of an HTML injection vulnerability via the parameter Work Space Name...
MOXA SDS-3008 security vulnerabilities
Moxa SDS-3008 is a series of industrial switches from MOXA China. The Moxa SDS-3008 suffers from an information disclosure vulnerability that can be exploited by an attacker to send specially crafted HTTP requests resulting in the disclosure of sensitive information...
PT-2023-18848 · Connectwise · Connectwise Control
Name of the Vulnerable Software and Affected Versions: Connectwise Control version 22.8.10013.8329 Description: The login page of Connectwise Control does not implement HSTS headers, which results in not enforcing HTTPS. The vendor's position is that this behavior is controlled by a configuration...
USN-5833-1 python-future vulnerability
Sebastian Chnelik discovered that python-future incorrectly handled certain HTTP header field. An attacker could possibly use this issue to cause a denial of service...
Wire security vulnerabilities
Wire is a chat program from the German company Wire. The software supports Web, WindowsiOS, Android, and OS X platforms, has a group feature, allows voice calls, sends photos as well as its original greeting method PING. A security vulnerability exists in versions of the Wire web-app prior to...
Socomec MODULYS GP security vulnerabilities
Socomec MODULYS GP is a green power device from Socomec, a French company. A security vulnerability exists in Socomec MODULYS GP version 7.20 and prior versions, which stems from its lack of strong encryption of credentials on HTTP connections that could allow threat actors to obtain sensitive...
golang: net/http: handle server errors after sending GOAWAY
A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...
CVE-2023-21850
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain component: E-Business Collections. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...
Oracle E-Business Suite security vulnerabilities
Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in Oracle E-Business...
golang: net/http: handle server errors after sending GOAWAY
A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...
Cisco BroadWorks Application: Input validation error vulnerability
Cisco BroadWorks Application is an enterprise-class calling and collaboration platform from Cisco USA. A security vulnerability exists in the Cisco BroadWorks Application Delivery Platform that stems from improper input validation when parsing HTTP, which can lead to a denial of service...