13560 matches found
CVE-2020-12424
Vulnerability CVE-2020-12424 affects Firefox earlier than 78, where a WebRTC permission prompt could be bypassed if a URI from the content process was untrusted and potentially the origin that had been previously granted permission. Connected advisories and vendor updates indicate this issue was ...
CVE-2020-12424
When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox 78...
CVE-2020-12424: Incorrect Default Permissions
When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox 78...
Mail.ru: Open Redirect at "city-mobil.ru"
Open redirection in city-mobil.ru via URI path with '@'...
CVE-2020-15537
An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI, or the Products Search box...
PT-2020-14487
Name of the Vulnerable Software and Affected Versions Vanguard plugin version 2.1 for WordPress Description An issue was discovered that allows XSS to occur via the mails/new title field, a product field to the "p/" URI, or the Products Search box. Recommendations For Vanguard plugin version 2.1,...
CVE-2020-15537: Improper Neutralization of Input During Web Page Generation
An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI, or the Products Search box...
Updated python-httplib2 packages fix security vulnerability
Updated python-httplib2 packages fix security vulnerability: In httplib2, an attacker controlling unescaped part of uri for httplib2.Http.request could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri...
OSV-2020-743 Heap-buffer-overflow in uri_decoder
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23818 Crash type: Heap-buffer-overflow READ 1 Crash state: uridecoder guriunescapebytes fuzzuriescape.c...
PT-2020-22513
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash involves the uri decoder and g uri unescape bytes functions in the fuzz uri escape.c file...
PT-2020-22511
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read, which was identified through an OSS-Fuzz report. The crash state indicates involvement of functions su...
OSV-2020-567 Heap-buffer-overflow in _iri_unescape_inline
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14449 Crash type: Heap-buffer-overflow READ 1 Crash state: iriunescapeinline wgetiriparse init...
WS-2020-0302
GNOME GLib in versions 2.65.1 to 2.66.0 has an heap-buffer-overflow caused by reading off the end of a URI if it had an incorrect %-escaped character in...
CVE-2020-13483
The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI...
CVE-2020-13483
The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI...
Cross site request forgery (csrf)
clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...
Viber URI Handling Vulnerability
Viber is a suite of cross-platform instant messaging software. A security vulnerability exists in Viber versions prior to 13.2.0.39 Windows that stems from not properly referencing its custom URI handler. An attacker can exploit the vulnerability by leveraging a malicious website that causes a us...
CVE-2020-14049
Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a victim to send an NTLM authentication request, and either relay the request or capture the hash for offline password cracking. NOTE: this...
CVE-2020-14049
Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a victim to send an NTLM authentication request, and either relay the request or capture the hash for offline password cracking. NOTE: this...
Cross site request forgery (csrf)
Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a victim to send an NTLM authentication request, and either relay the request or capture the hash for offline password cracking. NOTE: this...