CVE-2020-20095: Undefined Security Weakness

iMessage Messages app iOS 12.4 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages...

CVE-2020-20096: Undefined Security Weakness

Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages...

CVE-2020-20093: Undefined Security Weakness

The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages...

PT-2022-8607

Name of the Vulnerable Software and Affected Versions Facebook Messenger versions 227.0 and prior Facebook Messenger for Android versions 228.1.0.10.116 and prior Description The user interface of the Facebook Messenger app does not properly represent URI messages to the user, resulting in URI...

PT-2022-8610

Name of the Vulnerable Software and Affected Versions WhatsApp versions 2.19.80 and prior WhatsApp versions 2.19.222 and prior Description The user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages. Recommendations For...

PT-2022-8608

Name of the Vulnerable Software and Affected Versions Instagram versions 106.0 and prior iOS, 107.0.0.11 and prior Android Description The user interface does not properly represent URI messages to the user, resulting in URI spoofing via specially crafted messages. Recommendations For Instagram i...

OpenStack-Tripleo-Heat-Templates information leakage vulnerability

openstack-tripleo-heat-templates is a set of templates and tools for building Heat templates for OpenStack deployment. A security vulnerability exists in openstack-tripleo-heat-templates that stems from the fact that an attacker can exploit this by checking the wwwauthenticateuri parameter visibl...

PT-2022-8609

Name of the Vulnerable Software and Affected Versions iMessage Messages app versions prior to 12.4 Description The user interface of the iMessage app does not properly represent URI messages to the user. This results in URI spoofing via specially crafted messages. Recommendations For versions pri...

PT-2022-11485

Name of the Vulnerable Software and Affected Versions openstack-tripleo-heat-templates versions prior to 11.6.1 Description An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking...

CVE-2020-20094: Undefined Security Weakness

Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages...

Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise (CVE-2021-44531)

Summary IBM App Connect Enterprise ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2021-44531 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by t...

OPENSUSE-SU-2022:0873-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: Update to version jdk8u322 icedtea-3.22.0 Including the following security fixes: - CVE-2022-21248, bsc1194926: Enhance cross VM serialization - CVE-2022-21283, bsc1194937: Better String matching - CVE-2022-21293, bsc1194935: Improve...

SUSE-SU-2022:0871-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: Update to version jdk8u322 icedtea-3.22.0 Including the following security fixes: - CVE-2022-21248, bsc1194926: Enhance cross VM serialization - CVE-2022-21283, bsc1194937: Better String matching - CVE-2022-21293, bsc1194935: Improve...

CVE-2021-32478

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected...

CVE-2021-32478

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected...

CVE-2021-32478

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected...

UBUNTU-CVE-2021-32478

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected...

Cisco Nexus Dashboard Fabric Controller XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Nexus Dashboard Fabric Controller. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the AMF protocol. Due to the improper...

[SECURITY] Fedora 34 Update: libxml2-2.9.13-1.fc34

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

Accepting arbitrary Subject Alternative Name (SAN) types unless a PKI is specifically defined to use a particular SAN type can result in bypassing name-constrained intermediates. Node.js < 12.22.9 < 14.18.3 < 16.13.2 and < 17.3.1 was accepting URI SAN types which PKIs are often not defined to use. Additionally when a protocol allows URI SANs Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.

...