118 matches found
CVE-2022-28108: Cross-Site Request Forgery (CSRF)
Selenium Server Grid before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain...
PT-2022-7706
Name of the Vulnerable Software and Affected Versions Selenium Server Grid versions prior to 4 Description The issue is related to a CSRF vulnerability in the Selenium Server Grid tool. It allows non-JSON content types, such as application/x-www-form-urlencoded, multipart/form-data, and text/plai...
CVE-2021-23028
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall WAF/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests m...
Code injection
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall WAF/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests m...
CVE-2021-23028
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall WAF/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests m...
CVE-2021-23028
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall WAF/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests m...
CVE-2021-23028: Improper Input Validation
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall WAF/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests m...
PT-2021-15353
Name of the Vulnerable Software and Affected Versions F5 BIG-IP ASM versions 13.1.x through 13.1.4 F5 BIG-IP ASM versions 14.1.x through 14.1.4.2 F5 BIG-IP ASM versions 15.1.x through 15.1.3.1 F5 BIG-IP ASM versions 16.0.x through 16.0.1.2 Description When JSON content profiles are configured for...
CVE-2021-32677
FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery CSRF attack. I...
CVE-2021-23010: Undefined Security Weakness
On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and 12.1.x before 12.1.5.3, when the BIG-IP ASM/Advanced WAF system processes WebSocket requests with JSON payloads using the default JSON Content Profile in the ASM Security Policy, the BIG-...
Wikimedia Quarry analytics-quarry-web cross-site scripting vulnerability
Wikimedia Quarry analytics-quarry-web is an open source application. Wikimedia Quarry analytics-quarry-web is vulnerable to a cross-site scripting vulnerability. The vulnerability stems from the fact that app.py does not explicitly set the application json content type. No details of the...
PT-2018-16135 · Fastify · Fastify
Name of the Vulnerable Software and Affected Versions: Fastify versions prior to 0.38.0 Description: The issue allows for a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload. This can cause the service to become unresponsive...
Cross-site Scripting (XSS)
global-build-stats is vulnerable to reflected cross-site scripting XSS attacks. These attacks are possible because some URLs return JSON as Content Type: text/html. This content may be interpreted by clients as HTML allowing XSS to be performed. Cross-site request forgery CSRF attacks are also...
UBUNTU-CVE-2016-3168
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."...
Drupal Core Reflected File Download Vulnerability
Drupal is a free and open source content management system developed in PHP. A reflected file download vulnerability exists in Drupal Core. Allows an attacker to trick users into downloading and running arbitrary JSON file encoded content...
PT-2016-5397
Name of the Vulnerable Software and Affected Versions Drupal versions 6.x prior to 6.38 Drupal versions 7.x prior to 7.43 Description The issue might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded...
[SECURITY] [DSA 2948-1] python-bottle security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2948-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 04, 2014 http://www.debian.org/security/faq -...
