1683 matches found
Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20190715)
This update upgrades Thunderbird to version 60.8.0. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 CVE-2019-11709 - Mozilla: Sandbox escape via installation of malicious language pack CVE-2019-9811 - Mozilla: Script injection within domain through inner...
RHEL 6 : firefox (RHSA-2019:1765)
The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1765 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...
Oracle Linux 6 : firefox (ELSA-2019-1765)
The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-1765 advisory. 60.8.0-1.0.1 - fix LDLIBRARYPATH - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one Tenable has extracted the preceding...
Mozilla: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery CSRF attacks. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8...
CVE-2019-11712
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery CSRF attacks. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8...
CVE-2019-13071
CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST requests to any forms in the web application. This can be exploited by tricking an authenticated user into visiting an attacker controlled web page...
PT-2019-13109
Name of the Vulnerable Software and Affected Versions CyberPower PowerPanel Business Edition version 3.4.0 Description The issue allows an attacker to submit POST requests to any forms in the web application by exploiting a CSRF weakness in the Agent/Center component. This can be achieved by...
CVE-2019-13071: Cross-Site Request Forgery (CSRF)
CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST requests to any forms in the web application. This can be exploited by tricking an authenticated user into visiting an attacker controlled web page...
mozilla -- multiple vulnerabilities
Mozilla Foundation reports: CVE-2019-9811: Sandbox escape via installation of malicious language pack CVE-2019-11711: Script injection within domain through inner window reuse CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects CVE-2019-11713:...
The vulnerability of the BARS.Web-Sudy platform, related to deficiencies in the authentication mechanism, allows a hacker to select user account names.
The vulnerability of the BARS.Web-Sudy platform is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to select user accounts using specially crafted POST requests...
The vulnerability in the “Regional Capital Renovation Program Management” platform, related to deficiencies in the authentication mechanism, allows a violator to select user account names.
The vulnerability in the “Regional Program Capital Renovation Management” platform is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to select user accounts using specially crafted POST requests...
The vulnerability of the Microsoft Dynamics resource planning software, related to security configuration errors, allows a hacker to circumvent existing restrictions on embedded email files.
The vulnerability of the Microsoft Dynamics resource planning software is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to circumvent existing restrictions on email attachments by intercepting POST requests...
CVE-2019-11334
An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources that are not otherwise accessible without proper authentication via capture-replay. Physically proximate attackers can use this informatio...
Authentication flaw
An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources that are not otherwise accessible without proper authentication via capture-replay. Physically proximate attackers can use this informatio...
PT-2019-11731 · Jenkins +1 · Jenkins Electricflow Plugin +2
Name of the Vulnerable Software and Affected Versions: Jenkins ElectricFlow Plugin version 1.1.5 and earlier CloudBees CD Plugin affected versions not specified Description: A cross-site request forgery issue allows attackers to connect to a specified URL using specified credentials. This is due ...
UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting
Exploit Title: UliCMS 2019.1 "Spitting Lama" - Stored Cross-Site Scripting Google Dork: intext:"by UliCMS" Date: 2019-05-12 Exploit Author: Unk9vvN Vendor Homepage: https://en.ulicms.de Software Link: https://www.ulicms.de/aktuelles.html?single=ulicms-20191-spitting-lama-ist-fertig Version: 2019....
CSRF vulnerability in warnings-ng
warnings-ng did not require that requests sent to the endpoint used to reset warning counts use POST. This resulted in a cross-site request forgery vulnerability that allows attackers to reset warning counts for future builds. warnings-ng now requires that these requests be sent via POST...
CVE-2018-12296
Insufficient access control in /api/external/7.0/system.System.getinfos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests...
PT-2019-9720
Name of the Vulnerable Software and Affected Versions Virgin Media wireless router version 3.0 Description The web interface of the Virgin Media wireless router is susceptible to a denial of service issue. This occurs when POST requests are sent and the connection is kept open, causing the router...
CVE-2018-19037: Uncontrolled Resource Consumption
On Virgin Media wireless router 3.0 hub devices, the web interface is vulnerable to denial of service. When POST requests are sent and keep the connection open, the router lags and becomes unusable to anyone currently using the web interface...