Ubuntu 14.04 LTS / 16.04 LTS : Tomcat vulnerability (USN-3787-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3787-1 advisory. It was discovered that Tomcat incorrectly handled returning redirects to a directory. A remote attacker could possibly use this issue with a specially...

USN-3787-1 tomcat7, tomcat8 vulnerability

It was discovered that Tomcat incorrectly handled returning redirects to a directory. A remote attacker could possibly use this issue with a specially crafted URL to redirect to arbitrary URIs...

CVE-2018-8495

A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers...

CVE-2018-8495

A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers...

Design/Logic Flaw

This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific...

CVE-2018-10498

This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific...

Open redirect

sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site 'Open Redirect' vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's...

CVE-2018-1000671

sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site 'Open Redirect' vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's...

CVE-2018-1000671

sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site 'Open Redirect' vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's...

DEBIAN-CVE-2018-1000671

sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site 'Open Redirect' vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's...

CVE-2018-1000671

sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site 'Open Redirect' vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's...

CVE-2018-1000671

sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site 'Open Redirect' vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's...

CVE-2018-1000671

sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site 'Open Redirect' vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's...

Cross site request forgery (csrf)

MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users//edit/, and /accounts//delete/ URIs...

CVE-2018-16552

MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users//edit/, and /accounts//delete/ URIs...

PYSEC-2018-65

MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users//edit/, and /accounts//delete/ URIs...

Node.js: url.parse() hostname spoofing via javascript: URIs

Summary: Using url.parse in security sensitive checks is dangerous as an arbitrary hostname can be spoofed via javascript: URIs. Description: The original url.parse API is dangerous as it allows to spoof an arbitrary hostname via a javascript: URI: bash $ node -e...

CVE-2018-7475

Cross-site scripting XSS vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML...

Information disclosure

Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for the basic.htmlipsettings or basic.htmldatadelivery URI...

Design/Logic Flaw

Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of data: URIs in links and can therefore execute javascript...