CVE-2020-5883

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy and has an attached HTTPPROXYREQUEST iRule, POST requests sent to the virtual server cause an xdata memory leak...

F5 Networks BIG-IP : BIG-IP virtual server vulnerability (K12234501)

When a virtual server is configured with HTTP explicit proxy and has an attached HTTPPROXYREQUEST iRule, POST requests sent to the virtual server cause an xdata memory leak.CVE-2020-5883 Impact The BIG-IP system may become vulnerable to conditions that result when it is out of memory because of a...

PT-2020-13033 · Xt · Xt:Commerce

Name of the Vulnerable Software and Affected Versions: xt:Commerce versions 5.1 through 6.2.2 Description: The issue allows remote authenticated users to manipulate the id field in the POST request for altering an address, enabling them to zero out other users' stored addresses. Recommendations:...

Quantopian: Ability to perform various POST requests on quantopian.com as a different user - insecure by design.

Summary: Due to excessive control of victim's UI over algorithm collaboration feature one is able to force algorithm collaborator to issue malicious POST requests. Description: Hello again my favorite VDP! WebSockets again. Following vulnerability can be abused to attack a person that we...

Fedora 30 : coturn (2020-f3fcb1608a)

An exploitable heap overflow vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. - An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server...

Fedora 31 : coturn (2020-305c173af8)

An exploitable heap overflow vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. - An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server...

Unknown 'WildPressure' Malware Campaign Lets Off Steam in Middle East

A malware campaign that shares no known similarities to previous attacks has been uncovered, targeting organizations in the Middle East. Dubbed “WildPressure,” the campaign used a previously unknown malware that researchers named Milum, after the C++ class names inside the code. According to...

CVE-2020-10195

The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal...

Extended-XSS-Search - Scans For Different Types Of XSS On A List Of URLs

This is the extended version based on the initial idea already published as "xssfinder". This private version allows an attacker to perform not only GET but also POST requests. Additionally its possible to proxy every request through Burp or another tunnel. First steps Rename the...

The vulnerability of the RadAsyncUpload function in the Telerik UI framework for ASP.NET AJAX allows a hacker to execute arbitrary code in the target system.

The vulnerability of the RadAsyncUpload function in the Telerik UI for ASP.NET AJAX is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code on the target system by sending specially crafted POST requests...

DEBIAN-CVE-2020-6062

An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to server crash and denial of service. An attacker needs to send an HTTP request to trigger this vulnerability...

Heap overflow

An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. An attacker needs to send an HTTPS request to trigger this vulnerability...

CVE-2020-6061

An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. An attacker needs to send an HTTPS request to trigger this vulnerability...

CVE-2020-6062

CVE-2020-6062 affects coturn’s web server POST handling, where a crafted HTTP POST request can trigger a server crash and denial of service. The connected advisories confirm the same issue across multiple distributions and show the root cause as improper handling of POST requests. Affected produc...

Vulnerability Spotlight: Memory corruption, DoS vulnerabilities in CoTURN

Aleksandar Nikolic of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. CoTURN contains denial-of-service and memory corruption vulnerabilities in the way its web server parses POST requests. CoTURN is a TURN server implementation that can be used as a general- purpose network traff...

CoTURN HTTP Server POST-parsing information leak vulnerability

Summary An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. An attacker needs to send an HTTPS request to trigger this vulnerability. Teste...

CoTURN HTTP Server POST-parsing denial-of-service vulnerability

Summary An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to server crash and denial of service. An attacker needs to send an HTTP request to trigger this vulnerability. Tested Versions...

Cross-Site Request Forgery (CSRF)

webargs is vulnerable to cross-site request forgery CSRF. The Content-Type header resolves to application/json when JSON input is received. If the request body is valid JSON, the application accepts it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST reques...

CVE-2020-7965

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...

Cross site request forgery (csrf)

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made...