PT-2017-18348

Name of the Vulnerable Software and Affected Versions Brave version 0.12.4 Description The issue is related to URI Obfuscation, where a string such as https://[email protected]/ is displayed without clear UI indication that it is not a resource on the safe.example.com web site...

CVE-2017-8458: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Brave 0.12.4 has a URI Obfuscation issue in which a string such as https://[email protected]/ is displayed without a clear UI indication that it is not a resource on the safe.example.com web site...

CVE-2016-10368: URL Redirection to Untrusted Site

Open redirect vulnerability in Opsview Monitor Pro Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the...

CVE-2017-8225

On Wireless IP Camera P2P WIFICAM devices, access to .ini files containing credentials is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI...

CVE-2017-8225

On Wireless IP Camera P2P WIFICAM devices, access to .ini files containing credentials is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI...

CVE-2017-5191

An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header...

CVE-2017-5191: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header...

Cross site scripting

Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter...

CVE-2017-7992

Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter...

CVE-2017-7992: Improper Neutralization of Input During Web Page Generation

Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter...

[SECURITY] Fedora 24 Update: libxml2-2.9.4-2.fc24

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

Regular Expression Denial Of Service (ReDoS)

uri-js is vulnerable to denial of service DoS attacks. These attacks are possible through the regular expression that validates if a URL is validate. There is a flaw in the regular expression which causes the program to hang and the application to consume 100% of the CPU. This is only possible if...

Directory traversal

Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows remote attackers to read arbitrary files via a request to a vendor-supplied CGI script that is used to read HTML text file, but that does not do any URI/path...

HelpDEZk Cross-Site Request Forgery Vulnerability

HelpDEZk is a suite of PHP-based software for managing requests, events. A cross-site request forgery vulnerability exists in admin/home/person/ in HelpDEZk. It allows remote attackers to construct malicious URIs and trick users into parsing them, which can be used to perform malicious actions an...

Django Open Redirection Vulnerability

Django is prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

PT-2017-17613

Name of the Vulnerable Software and Affected Versions Dahua IP Camera devices version 3.200.0001.6 Description The issue allows exploitation of Dahua IP Camera devices by using default low-privilege credentials to list all users via a request to a certain URI, and then logging in with admin...

Directory Traversal

JavaServer Faces is vulnerable to directory traversals. A malicious user can access arbitrary files through a Uniform Resource Identifier or a through the library name...

Disk Savvy Enterprise long URI in GET request buffer overflow

Added: 03/16/2017 CVE: CVE-2017-6187 BID: 96401 Background Disk Savvy Enterprise is a disk space usage analyzer. Problem A buffer overflow in the built-in web server in Disk Savvy Enterprise could allow remote code execution when handling a long URI in a GET request. Resolution Contact the vendor...

CVE-2017-5359: Improper Input Validation

EasyCom SQL iPlug allows remote attackers to cause a denial of service via the D$EVAL parameter to the default URI...

PT-2017-16453

Name of the Vulnerable Software and Affected Versions EasyCom SQL iPlug affected versions not specified Description The issue allows remote attackers to cause a denial of service. This can be achieved via the D$EVAL parameter to the default URI. Recommendations At the moment, there is no...