CVE-2017-5450: Improper Input Validation

A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base domain is parsed incorrectly, making the resulting location less visibly a spoofed site and showing an incorrect domain in appended notifications. This vulnerability affects Firefox...

freeswitch.org XSS vulnerability

Open Bug Bounty ID: OBB-629038 Description| Value ---|--- Affected Website:| freeswitch.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PT-2018-11406

Name of the Vulnerable Software and Affected Versions Apache MXNet versions prior to 1.0.0 Description The issue allows attackers to access the MXNet instance on unexpected network interfaces. In clustered setups, users can specify the IP address and port for the scheduler using the DMLC PS ROOT...

Samsung Email Arbitrary File Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Samsung Email. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

GE MDS PulseNET IntegrationXMLProcessorServlet UpdateProblemTickets XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of GE MDS PulseNET. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the UpdateProblemTickets method of the...

GE MDS PulseNET IntegrationXMLProcessorServlet AlarmActions XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of GE MDS PulseNET. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the AlarmActions method of the IntegrationXMLProcessorServle...

GE MDS PulseNET XmlAdapterServlet XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of GE MDS PulseNET. Authentication is not required to exploit this vulnerability. The specific flaw exists within the XmlAdapterServlet servlet. Due to the improper restriction of XML External...

GE MDS PulseNET FglAMServlet XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of GE MDS PulseNET. Authentication is not required to exploit this vulnerability. The specific flaw exists within the FglAMServlet servlet. Due to the improper restriction of XML External Enti...

Google Web Designer URI Parsing Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Google Web Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processi...

GE MDS PulseNET MagnumEmulator Servlet XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of GE MDS PulseNET. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MagnumEmulator servlet. Due to the improper restriction of XML External...

CVE-2017-16021

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

Code injection

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

anvil-connect (>=0.1.0, <=0.1.39), anvil-connect-jwt (>=0.1.0, <=0.1.2) +49 more potentially affected by CVE-2017-16021 via uri-js (>=1.4.2, <=2.1.1)

uri-js NPM version =1.4.2, =0.1.0, =0.1.0, =0.1.0, =0.2.12, =1.15.0, =0.1.0, =0.1.2, =0.4.2, =1.0.0, =0.0.1, =1.0.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2017-16021 Source advisory: MEND:CVE-2017-16021...

CVE-2017-16021

The CVE-2017-16021 issue affects uri-js up to v2.1.1 where a RegExp-based URL validation can cause a Denial of Service (high CPU usage) when processing user input via parse(). Fedora/Nessus/OpenVAS entries reference CVE-2017-16021 and indicate to update to a newer nodejs-uri-js release to fix the...

CVE-2017-16021

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

CVE-2017-16021

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

Cross site scripting

wpforogetrequesturi in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting XSS via the URI...

CVE-2018-11709: Improper Neutralization of Input During Web Page Generation

wpforogetrequesturi in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripting XSS via the URI...

CVE-2017-16021: Uncontrolled Resource Consumption

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

PT-2018-10767

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin versions prior to 1.4.12 Description The issue allows Unauthenticated Reflected Cross-Site Scripting XSS via the URI. This is due to the wpforo get request uri function in wpf-includes/functions.php. Recommendations For...