2622 matches found
The vulnerability of the Gem owner command in the RubyGems package management system, related to the output of API responses into the standard output stream, allows a hacker to compromise data integrity.
The vulnerability of the Gem owner command in the RubyGems package management system is related to the way API responses are printed to the standard output stream. Exploiting this vulnerability allows a remote attacker to compromise data integrity by using a specially crafted escape sequence...
The vulnerability of the Gem::GemcutterUtilities module in the RubyGems package management system, which relates to the issue of printing API responses into the standard output stream, allows a attacker to compromise data integrity.
The vulnerability of the Gem::GemcutterUtilities module in the RubyGems package management system relates to the way that API responses are printed into the standard output stream. Exploiting this vulnerability could allow a malicious actor to compromise data integrity by using a specially crafte...
CVE-2020-9353
An issue was discovered in SmartClient 12.0. The Remote Procedure Call RPC loadFile provided by the console functionality on the /tools/developerConsoleOperations.jsp or /isomorphic/IDACall URL is affected by unauthenticated Local File Inclusion via directory-traversal sequences in the elem XML...
D-Link DGS-1250 Header Injection
D-Link DGS-1250 header injection vulnerability ============================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/d-link-dgs-1250-header-injection.txt Overview -------- D-Link DGS-1250 switch is susceptible to a header injection...
CVE-2015-3154
CRLF injection vulnerability in Zend\Mail ZendMail in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email...
CVE-2018-10546
An infinite loop vulnerability was found in ext/iconv/iconv.c in PHP due to the iconv stream not rejecting invalid multibyte sequences. A remote attacker could use this vulnerability to hang the php process and consume resources...
Predictable TCP sequences generated by Security Gateway in R80.20 / R80.30
...
Huawei EulerOS: Security Advisory for php (EulerOS-SA-2018-1309)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for php (EulerOS-SA-2019-1249)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2019-1990)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
MGASA-2020-0028 Updated libtomcrypt packages fix security vulnerability
Updated libtomcrypt packages fix security vulnerability: Improper detection of invalid UTF-8 sequences that could have led to DoS or information disclosure via crafted DER-encoded data CVE-2019-17362...
DEBIAN-CVE-2012-2142
The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a terminal emulator...
Cross-Site Scripting in Filelist Module
It has been discovered that the output table listing in the “Files” backend module is vulnerable to cross-site scripting when a file extension contains malicious sequences...
CVE-2019-16771
Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in...
CVE-2019-16771
Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in...
Cross site scripting
Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in...
Debian DLA-2015-1 : nss security update
Handling of Netscape Certificate Sequences in CERTDecodeCertPackage may haved crash with a NULL deref leading to a denial of service. For Debian 8 'Jessie', this problem has been fixed in version 2:3.26-1+debu8u8. We recommend that you upgrade your nss packages. NOTE: Tenable Network Security has...
SUSE-SU-2019:3095-1 Security update for libtomcrypt
This update for libtomcrypt fixes the following issues: - CVE-2019-17362: Fixed an improper detection of invalid UTF-8 sequences that could have led to DoS or information disclosure via crafted DER-encoded data bsc1153433...
Chaturbate: Camo Image Proxy Bypass with CSS Escape Sequences
Summary With CSS escape sequences it is possible to bypass CSS url detection and filtering. Details Users can use HTML tags in their Profile Bio in About Me and Wish List fields. Among other filtering and sanitization, image URLs are replaced by URLs on internal image proxy. For example, this...