732 matches found
CVE-2019-9852
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...
CVE-2019-9852
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...
CVE-2019-9852
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...
CVE-2019-9852: Improper Encoding or Escaping of Output
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...
X (Formerly Twitter): Wrong Interpretation of URL encoded characters, showing different punny code leads to redirection on different domain
Summary: There is wrong interpretation of URL encoded characters at https://twitter.com/safety/unsafelinkwarning endpoint which could lead to different location then what is supposed to. Although it shows warning but doesn't show warning about punny code characters. Description: On following...
CVE-2019-6972
An issue was discovered on TP-Link TL-WR1043ND V2 devices. The credentials can be easily decoded and cracked by brute-force, WordList, or Rainbow Table attacks. Specifically, credentials in the "Authorization" cookie are encoded with URL encoding and base64, leading to easy decoding. Also, the...
CVE-2019-6972
The CVE-2019-6972 issue affects TP-Link TL-WR1043ND V2 devices. The vulnerability arises from credentials stored in the Authorization cookie being URL-encoded and base64 encoded, making them easily decoded; the username is in cleartext and the password is MD5-hashed after decoding. This exposes w...
PT-2019-18390
Name of the Vulnerable Software and Affected Versions TP-Link TL-WR1043ND version V2 Description An issue allows credentials to be easily decoded and cracked through brute-force, WordList, or Rainbow Table attacks. The credentials in the "Authorization" cookie are encoded with URL encoding and...
Sitecore 8.x - Deserialization Remote Code Execution
Sitecore 8.x - Deserialization Remote Code Execution Exploit Title: Sitecore v 8.x Deserialization RCE Date: Reported to vendor October 2018, fix released April 2019. Exploit Author: Jarad Kopf Vendor Homepage: https://www.sitecore.com/ Software Link: Sitecore downloads:...
PT-2019-2558
Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 6.0.2 and below Description The issue allows an attacker to execute unauthorized code or commands via attack reports generated in HTML form due to the lack of encoding of the URL part of the report message. This may...
Design/Logic Flaw
Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959...
CVE-2018-19106
Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959...
CVE-2018-19106
Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959...
CVE-2018-19106
Avi Vantage prior to 17.2.13 is affected by an improper URL encoding during a redirect operation (AV-33959). Summary: the vulnerability stems from incorrect URL encoding in the redirect flow, as documented in CVE-2018-19106. The available sources confirm the affected product/version and the root ...
CVE-2018-19106: URL Redirection to Untrusted Site
Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959...
PT-2019-9729
Name of the Vulnerable Software and Affected Versions Avi Vantage versions prior to 17.2.13 Description The issue arises from the use of an invalid URL encoding during a redirect operation. Recommendations For versions prior to 17.2.13, update to version 17.2.13 or later to resolve the issue...
Cross-Site Scripting (XSS)
flowplayer is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser by via the callback parameter using URL encoding. This vulnerability exists due to an incomplete fix for CVE-2013-7342...
CVE-2018-6076
Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page...
Design/Logic Flaw
Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page...