Phabricator: Window.opener fix bypass

Description Due to a recent reporthttps://hackerone.com/reports/306414 a fix was deployed in order to resolve the tabnabbing issue. However by using a line break the fix can be bypassed. Steps to reproduce 1 Browse to your Phabricator instance and create a new document. 2 Now paste in the followi...

PostgreSQL < 8.4.11 / 9.0.7 / 9.1.3 Multiple Vulnerabilities

Binary data 6817.prm...

postgresql: SQL injection due unsanitized newline characters in object names

CRLF injection vulnerability in pgdump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQ...

pidgin: Finch XMPP MUC Crash

libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat MUC room is used, does not properly parse nicknames containing sequences, which allows remote attackers to cause a denial of service application crash via a crafted nickname...

DEBIAN-CVE-2009-0759

Multiple CRLF injection vulnerabilities in webadmin in ZNC before 0.066 allow remote authenticated users to modify the znc.conf configuration file and gain privileges via CRLF sequences in the quit message and other vectors...