CVE-2019-16763

In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs or vbscript:, allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The most plausible potential attack would be if...

openSUSE Security Update : squid (openSUSE-2019-2541)

This update for squid to version 4.9 fixes the following issues : Security issues fixed : - CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi bsc1140738. - CVE-2019-12526: Fixed potential remote code execution during URN processing bsc1156326. -...

openSUSE Security Update : squid (openSUSE-2019-2540)

This update for squid to version 4.9 fixes the following issues : Security issues fixed : - CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi bsc1140738. - CVE-2019-12526: Fixed potential remote code execution during URN processing bsc1156326. -...

openSUSE: Security Advisory for squid (openSUSE-SU-2019:2540-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

DEBIAN-CVE-2019-18887

An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel...

CVE-2019-16340

Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfojson.cgi URI...

CVE-2019-16340

Belkin Linksys Velop devices running version 1.1.8.192419 expose a sensitive detail: the recovery key can be obtained by an unauthenticated remote attacker via a direct request to /sysinfo_json.cgi. This CVE (CVE-2019-16340) is documented across multiple sources with the same description, confirm...

Security update for squid (important)

openSUSE Security Update: Security update for squid Announcement ID: openSUSE-SU-2019:2540-1 Rating: important References: 1133089 1140738 1141329 1141330 1141332 1141442 1156323 1156324 1156326 1156328 1156329 Cross-References: CVE-2019-12523 CVE-2019-12525 CVE-2019-12526 CVE-2019-12527...

Moodle CVE-2019-14882 Open Redirection Vulnerability

Description Moodle is prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to a...

SUSE SLES15 Security Update : squid (SUSE-SU-2019:2975-1)

This update for squid to version 4.9 fixes the following issues : Security issues fixed : CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi bsc1140738. CVE-2019-12526: Fixed potential remote code execution during URN processing bsc1156326...

PT-2019-5184

Name of the Vulnerable Software and Affected Versions Squid versions 3.x through 4.8 Description An issue was discovered due to incorrect input validation, resulting in a heap-based buffer overflow that can cause Denial of Service to all clients using the proxy. The severity is high because this...

EulerOS 2.0 SP5 : webkitgtk3 (EulerOS-SA-2019-2196)

According to the version of the webkitgtk3 package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could...

Mozilla: Unintended access to a privileged JSONView object

A vulnerability was found in Mozilla Firefox and Thunderbird. Privileged JSONView objects that have been cloned into content can be accessed using a form with a data URI. This flaw bypasses existing defense-in-depth mechanisms and can be exploited over the network...

Cisco Managed Services Accelerator CVE-2019-15974 Open Redirection Vulnerability

Description Cisco Managed Services Accelerator is prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link,...

RHEL 8 : GNOME (RHSA-2019:3553)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3553 advisory. GNOME is the default desktop environment of Red Hat Enterprise Linux. Security Fixes: evince: uninitialized memory use in function...

mod_auth_mellon: open redirect in logout url when using URLs with backslashes

A vulnerability was found in modauthmellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. Thi...

webkitgtk: processing maliciously crafted web content lead to URI spoofing

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge...

CVE-2019-17221

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...

CVE-2019-17221

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...

PT-2019-15014

Name of the Vulnerable Software and Affected Versions PhantomJS versions 2.1.1 and earlier Description The issue allows for arbitrary file read, demonstrated by an XMLHttpRequest for a file:// URI. It exists in the page.open function of the webpage module, which loads a specified URL and calls a...