11691 matches found
CVE-2019-20372
NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. Mitigation To mitigate this issue, use a named location instead ...
Google Chrome memory misreference vulnerability (CNVD-2020-02985)
Chrome is a web browsing tool developed by Google. A memory misreference vulnerability exists in audio in versions prior to Google Chrome 79.0.3945.117. A remote attacker can exploit this vulnerability to cause heap corruption via specially crafted HTML pages...
A Facebook Bug Exposed Anonymous Admins of Pages
A bad code update allowed anyone to easily reveal which accounts posted to Facebook Pages—including celebrities and politicians—for several hours...
CVE-2012-3824
In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization...
UBUNTU-CVE-2019-20372
NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer...
Heap overflow
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in readpagesmap in decoder2007.c...
SQL Injection Vulnerability in jianbook a***x.asp Page
jianbook is an ultra-clean online message system, the system is developed by asp + Access, the front-end backend in one. SQL injection vulnerability exists in the jianbook ax.asp page, which can be exploited by attackers to obtain sensitive information from the database...
jianbook has a flawed logic vulnerability
jianbook is an ultra-clean online message system, the system is developed by asp + Access, the front-end backend in one. jianbook has a logic flaw vulnerability that can be exploited by attackers to bypass authentication and obtain administrator privileges...
VulnCheck KEV: CVE-2016-1555
Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution...
Google Chrome Resource Management Error Vulnerability (CNVD-2020-00998)
Google Chrome is a web browser from Google, an American company. A resource management error vulnerability exists in versions of Google Chrome prior to 77.0.3865.75, which can be exploited by remote attackers to cause heap corruption with the help of specially crafted HTML pages...
[SECURITY] Fedora 31 Update: php-7.3.13-1.fc31
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...
CVE-2019-9553
Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933...
CVE-2019-9553
Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933...
UBUNTU-CVE-2019-19927
In the Linux kernel 5.0.0-rc7 as distributed in ubuntu/linux.git on kernel.ubuntu.com, mounting a crafted f2fs filesystem image and performing some operations can lead to slab-out-of-bounds read access in ttmputpages in drivers/gpu/drm/ttm/ttmpagealloc.c. This is related to the vmwgfx or ttm modu...
WordPress bbPress Login Register Links On Forum Topic Pages plugin <= 2.7.5 - Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) vulnerability
CSRF to Stored XSS vulnerability found in WordPress bbPress Login Register Links On Forum Topic Pages plugin versions = 2.7.5. Solution Update the WordPress bbPress Login Register Links On Forum Topic Pages plugin to the latest available version at least 2.8.5...
Unauthorized access vulnerability in geoserver
GeoServer is a J2EE implementation of the OpenGIS Web Server specification. GeoServer makes it easy to publish map data, allows users to update, delete and insert feature data, and makes it easy to share spatial geographic information between users. There is an unauthorized access vulnerability i...
GitLab Resource Management Error Vulnerability (CNVD-2020-03053)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A resource management error vulnerability exists in GitLa...
Privilege Escalation
Contao is susceptible to privilege escalation. The attack exists because it lacks the check to control the back end users from accessing details view URL to show restricted pages and articles...
Google Chrome Input Validation Error Vulnerability (CNVD-2020-00482)
Google Chrome is a web browser from Google, Inc. and Omnibox is a real-time search engine. Google Chrome suffers from an input validation error vulnerability. An attacker can exploit this vulnerability to spoof Omnibox content with the help of specially crafted HTML pages on iOS...