CVE-2020-6827

When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI. Note: This issue only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox ESR...

CVE-2020-6827

When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI. Note: This issue only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox ESR...

CVE-2020-6823

A malicious extension could have called browser.identity.launchWebAuthFlow, controlling the redirecturi, and through the Promise returned, obtain the Auth code and gain access to the user's account at the service provider. This vulnerability affects Firefox 75...

CVE-2020-6823

A malicious extension could have called browser.identity.launchWebAuthFlow, controlling the redirecturi, and through the Promise returned, obtain the Auth code and gain access to the user's account at the service provider. This vulnerability affects Firefox 75...

CVE-2020-6827

CVE-2020-6827 affects Mozilla Firefox for Android (Firefox ESR < 68.7) where following a link that opens an intent://-schemed URL could cause a custom tab to display an incorrect URI, enabling URI spoofing. The issue is reported across Firefox ESR

CVE-2020-6827

When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI. Note: This issue only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox ESR...

CVE-2020-6827

When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI. Note: This issue only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox ESR...

The vulnerability of the `jango.utils.encoding.uri_to_iri` function in the Django web development framework allows a attacker to trigger a denial-of-service attack.

The vulnerability of the jango.utils.encoding.uritoiri function in the Django web development framework is related to incorrect encoding of UTF-8 octal sequences. This can lead to excessive memory usage due to recursion. Exploiting this vulnerability could allow a remote attacker to cause a servi...

python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms

urllib in Python 2.x through 2.7.16 supports the localfile: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen'localfile:///etc/passwd' call...

OPENSUSE-SU-2020:0493-1 Security update for MozillaFirefox

This update for MozillaFirefox to version 68.7.0 ESR fixes the following issues: - CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage method bsc1168874. - CVE-2020-6822: Fixed out of bounds write in GMPDecodeData when processing large images bsc1168874. -...

Man-in-the-Middle (MitM)

httpd is vulnerable to man-in-the-middle MiTM. The vulnerability exists as it was discovered that the fix for CVE-2011-3368 released via RHSA-2011:1391 did not completely address the problem. An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly...

Phishing Attacks

mailman is vulnerable to phishing attacks. The vulnerability exists as a remote attacker could spoof messages in the error log, and possibly trick the administrator into visiting malicious URLs via a carriage return/line feed sequence in the URI...

SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:0978-1)

This update for MozillaFirefox to version 68.7.0 ESR fixes the following issues : CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage method bsc1168874. CVE-2020-6822: Fixed out of bounds write in GMPDecodeData when processing large images bsc1168874...

SUSE-SU-2020:0978-1 Security update for MozillaFirefox

This update for MozillaFirefox to version 68.7.0 ESR fixes the following issues: - CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage method bsc1168874. - CVE-2020-6822: Fixed out of bounds write in GMPDecodeData when processing large images bsc1168874. -...

Starbucks: Korea - LFI Server directory traversal at starbucks.co.kr

b4bilal discovered a misconfiguration when handling URI paths. This permitted an adversary to traverse the docroot and access non sensitive resources that are normally unavailable to web users. @b4bilal — thank you for reporting this vulnerability and for confirming the resolution...

CVE-2019-11717

A vulnerability exists where the caret "^" character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8...

SUSE-SU-2020:14339-1 Security update for MozillaFirefox

This update for MozillaFirefox to version 68.7.0 ESR fixes the following issues: - CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage method bsc1168874. - CVE-2020-6822: Fixed out of bounds write in GMPDecodeData when processing large images bsc1168874. -...

envoy: crafted request with long URI allows remote attacker to cause denial of service

A flaw was found in Envoy through version 1.11.1. Users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service through memory consumption. The highest thre...

CVE-2020-11628

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. It is intended to support restriction of available remote protocols CMP, ACME, REST, etc. through the system configuration. These restrictions can be bypassed by modifying the URI string from a client. EJBCA's internal acces...

PT-2020-12659

Name of the Vulnerable Software and Affected Versions: Rank Math plugin versions 1.0.40.2 and earlier Description: The issue allows unauthenticated remote attackers to create new URIs that redirect to an external web site via the unsecured "rankmath/v1/updateRedirection" REST API endpoint. This...