13585 matches found
CVE-2016-1942: Improper Input Validation
Mozilla Firefox before 44.0 allows user-assisted remote attackers to spoof a trailing substring in the address bar by leveraging a user's paste of a 1 wyciwyg: URI or 2 resource: URI...
Lenovo SHAREit Wifi hotspot information leakage vulnerability
Lenovo SHAREit 茄子快传 for Windows is a Windows-based file-sharing software from Lenovo, China.Wifi hotspot is one of the Wifi hotspot components. An information disclosure vulnerability exists in the Wifi hotspot component of Lenovo SHAREit for Windows versions prior to 3.2.0. A remote attacker can...
PT-2016-4934
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 44.0 Description The issue allows remote attackers to spoof a trailing substring in the address bar by leveraging a user's paste of a 1 wyciwyg: URI or 2 resource: URI. This can be achieved when a user assists...
Oracle Application Testing Suite Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Oracle Application Testing Suite. The specific flaw exists within the isAllowedUrl function. This function has a list of URI entries which do not require authentication. Because the function only...
Directory traversal
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Test Manager for Web Apps, a different vulnerability than...
Regular Expression Denial of Service
Overview Versions of hawk prior to 3.1.3, or 4.x prior to 4.1.1 are affected by a regular expression denial of service vulnerability related to excessively long headers and URI's. Recommendation Update to hawk version 4.1.1 or later. References - Issue 168 - GitHub Advisory...
asterisk -- Long Contact URIs in REGISTER requests can crash Asterisk
The Asterisk project reports: Asterisk may crash when processing an incoming REGISTER request if that REGISTER contains a Contact header with a lengthy URI. This crash will only happen for requests that pass authentication. Unauthenticated REGISTER requests will not result in a crash occurring...
Crlf injection
CRLF injection vulnerability in the onreq function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI...
CVE-2016-1133
CRLF injection vulnerability in the onreq function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI...
CVE-2016-1133: Undefined Security Weakness
CRLF injection vulnerability in the onreq function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI...
Google Android Market URI Denial of Service (CVE-2012-6301)
A Denial of Service vulnerability has been reported in Google Android. The vulnerability is due to an insufficient validation of URI in the SRC attribute of an IFRAME element. A remote attacker can exploit this issue by enticing a victim to open a specially crafted web page...
Mozilla: Cross-site reading attack through data: and view-source: URIs (MFSA 2015-149)
Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs...
Updated thunderbird packages fix security vulnerabilities
Updated thunderbird packages fix security vulnerabilities: Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird...
thunderbird: multiple issues
CVE-2015-7201 cross-origin restriction bypass using data: and view-source: uri scheme: Security researcher Tsubasa Iinuma reported a mechanism to violate same-origin policy to content using data: and view-source: URIs to confuse protections and bypass restrictions. This resulted in the ability to...
HP StoreOnce Backup System Cross-Site Request Forgery Vulnerability
HP StoreOnce Backup System is a disk-based backup system. A cross-site request forgery vulnerability exists in HP StoreOnce Backup System, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious actions in the context of the target user...
Mozilla Firefox Same-Origin Policy Bypass Vulnerability (CNVD-2015-08332)
Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A security vulnerability exists in Mozilla Firefox versions prior to 43.0 and Firefox ESR version...
Redmine Open Redirect Vulnerability
Redmine is a set of open source Web-based project management and defect tracking tools . An open redirection vulnerability exists in Redmine. An attacker can exploit this vulnerability by constructing a specially crafted URI and enticing a user to access it, redirecting the user to an arbitrary W...
CVE-2015-7211
Mozilla Firefox before 43.0 mishandles the number sign character in a data: URI, which allows remote attackers to spoof web sites via unspecified vectors...
