CVE-2019-12101

coapdecodeoption in coap.c in LibNyoci 0.07.00rc1 mishandles certain packets with "Uri-Path: null" and consequently allows remote attackers to cause a denial of service segmentation fault...

Updated python packages fix security vulnerability

Updated python packages fix security vulnerability: A 'file:' blacklist bypass in URIs by using the 'local-file:' scheme instead CVE-2019-9948...

Arbitrary Code Execution

Firefox, Firefox ESR and Thunderbird are vulnerable to arbitrary code execution attacks. A remote unauthenticated attacker could exploit the vulnerable URI Handler component by spoofing the origin of a modal alert via iframe content and the 'data:' protocol leading to potential code execution...

Remote Code Execution (RCE)

firefox/thunderbird is vulnerable to remote code execution. A use-after-free vulnerability in the HTMLVideoElement interface allows remote attackers to execute arbitrary code via Javascript code that modifies the URI table of a media element...

Cross-site Scripting (XSS)

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Fedora 30 : webkit2gtk3 (2019-d9a15be3ba)

Do not allow changes in active URI before provisional load starts for non-API requests. - Stop the threaded compositor when the page is not visible or layer tree state is frozen. - Use WebKit HTTP source element again for adaptive streaming fragments downloading. - Properly handle empty resources...

CVE-2019-11626

routers/ajaxRouter.php in doorGets 7.0 has a web site physical path leakage vulnerability, as demonstrated by an ajax/index.php?uri=1234%5c request...

Cross site request forgery (csrf)

An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1. CSRF can occur via a /CollatWebApp/gcmsRefInsert?name=SUPP URI...

Atlassian SourceTree 1.2 < 3.1.1 Multiple remote code execution vulnerabilities

The version of Atlassian SourceTree installed on the remote Windows host is version 1.2 prior to 3.1.1. It is, therefore, affected by multiple remote code execution vulnerabilities. - An option injection vulnerability exists in the git submodule component. An unauthenticated, remote attacker can...

PT-2019-12433

Name of the Vulnerable Software and Affected Versions doorGets version 7.0 Description The issue is related to a web site physical path leakage. This can be demonstrated by sending a request to the 'ajax/index.php?uri=1234' endpoint, which is handled by the routers/ajaxRouter.php file in doorGets...

Code injection

esoTalk 1.0.0g4 has XSS via the PATHINFO to the conversations/ URI...

CVE-2015-9285

esoTalk 1.0.0g4 has XSS via the PATHINFO to the conversations/ URI...

CVE-2015-9285

CVE-2015-9285 affects esoTalk 1.0.0g4. The vulnerability is a reflected XSS via PATH_INFO to the conversations/ URI. NVD CVSS data: CVSS v2 base score 4.3 (MEDIUM) with network attack vector and no confidentiality impact but partial integrity impact; CVSS v3 base score 6.1 (MEDIUM) with network a...

CVE-2015-9285

esoTalk 1.0.0g4 has XSS via the PATHINFO to the conversations/ URI...

CVE-2015-9285

esoTalk 1.0.0g4 has XSS via the PATHINFO to the conversations/ URI...

PT-2019-7244

Name of the Vulnerable Software and Affected Versions esoTalk version 1.0.0g4 Description The issue is related to a security problem where an attacker can execute malicious scripts via the PATH INFO to the conversations/ URI, potentially leading to unauthorized actions on the affected system...

CVE-2015-9285: Improper Neutralization of Input During Web Page Generation

esoTalk 1.0.0g4 has XSS via the PATHINFO to the conversations/ URI...

CVE-2019-11567

An issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $GET'del', as demonstrated by an admin/page/system/nav.php?del= URI...

CVE-2019-11567

An issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $GET'del', as demonstrated by an admin/page/system/nav.php?del= URI...

CVE-2019-9794

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the...