426 matches found
Squid URI processor buffer overflow vulnerability
Squid is a suite of proxy server and web caching server software. The software provides caching the World Wide Web , filtering traffic , proxy Internet access , etc. URI processor is one of the URI Uniform Resource Identifier processor . The URI processor in Squid has a buffer overflow...
Envoy Resource Management Error Vulnerability
Envoy is an open source distributed proxy server . A resource management error vulnerability exists in Envoy 1.11.1 and earlier versions, which can be exploited by a remote attacker to cause a denial of service memory consumption by sending a request with a long URI...
Mozilla: Caret character improperly escaped in origins
A vulnerability exists where the caret "^" character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8...
CVE-2018-19447
A stack-based buffer overflow can occur for specially crafted PDF files in Foxit Reader SDK ActiveX 5.4.0.1031 when parsing the URI string. An attacker can leverage this to gain remote code execution...
The vulnerability of the network software tool Envoy, related to errors in URI normalization, allows a intruder to gain unauthorized access to protected data.
The vulnerability of the network software tool Envoy is related to errors in normalizing URI addresses. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected data...
PYSEC-2019-128
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...
PYSEC-2019-128
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...
PYSEC-2019-58
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...
CVE-2019-6739
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page. There is an issue with the way the product handle...
CVE-2018-20165
Cross-site scripting XSS vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgnextoid parameter to a menuitem URI...
CVE-2018-20236
There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system...
UBUNTU-CVE-2019-7732
In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field username, realm, nonce, uri, or response, only the last instance can ever be freed...
The vulnerability of Cisco Unified Communications Domain Manager relates to insufficient protection of the website structure, allowing attackers to inject arbitrary code into the uploaded web pages.
The vulnerability of the Cisco Unified Communications Domain Manager relates to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted URI address from a remote location...
Google Android Information Disclosure Vulnerability (CNVD-2018-26776)
Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An information disclosure vulnerability exists in several functions of the ContentProvider.java file in Android, which stems from the program's failure to verify URIs and can be...
CVE-2018-9548
In multiple functions of ContentProvider.java, there is a possible permission bypass due to a missing URI validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions:...
undertow: Client can use bogus uri in Digest authentication
It was discovered that when using Digest authentication, the server does not ensure that the value of the URI in the authorization header matches the URI in the HTTP request line. This allows the attacker to execute a MITM attack and access the desired content on the server...
GHSA-89GC-6CW6-4VCH Spark allows remote attackers to read arbitrary files via a .. (dot dot) in the URI
Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the URI...
CVE-2018-15832
upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI...
CVE-2018-16956
The AjaxControl component of Oracle WebCenter Interaction Portal 10.3.3 does not validate the names of pages when processing page rename requests. Pages can be renamed to include characters unsupported for URIs by the web server hosting the WCI Portal software such as IIS. Renaming pages to inclu...