CVE-2019-15276

A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially...

CVE-2019-15276

A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially...

CVE-2019-15276

CVE-2019-15276: Cisco Wireless LAN Controller HTTP parsing DoS . The vulnerability affects Cisco WLC software (versions 8.4–8.9, 8.10 fixed) where the HTTP parsing engine fails to handle specially crafted URLs. An attacker with low privileges (or a user who can be lured to click a crafted URL) ca...

Cross-Site Scripting (XSS)

Pannellum is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser due to insufficient sanitization for data URLs such as vbscript:...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private - Go (CVE-2019-14809)

Summary A Security Vulnerability affects IBM Cloud Private - Go Vulnerability Details CVEID: CVE-2019-14809 DESCRIPTION: Go could allow a remote attacker to bypass security restrictions, caused by improper handling of hosts in URLs. By using a specially-crafted host, an attacker could exploit thi...

Cisco Email Security Appliance URL Filtering Bypass Vulnerability

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An...

Moodle 3.6.x < 3.6.7, 3.7.x < 3.7.3 Multiple Vulnerabilities

Moodle is prone to a vulnerability where email media URLs were not checked for the user status. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

python3 security and bug fix update

3.6.8-15.1.0.1 - Add Oracle Linux distribution in platform.py Orabug: 20812544 3.6.8-15.1 - Patch 329 FIPS modified: Added workaround for modssl: Skip error checking in Pyhashlibfipserror Resolves: rhbz1760106 3.6.8-15 - Patch 329 that adds support for OpenSSL FIPS mode has been improved and...

CVE-2012-2237

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 javascript innerHTML as used when generating login forms, 2 links or 3 resources URLs, and 4 the Display nam...

Microsoft Edge Security Bypass Vulnerability (CNVD-2019-42801)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. A security vulnerability exists in Microsoft Edge EdgeHTML-based, which arises from the program failing to properly handle extension requests and failing to request host privileges for...

golang: malformed hosts in URLs leads to authorization bypass

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname nor Port, and is related to a non-numeric port number. For example, an...

CVE-2019-10160

A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies,...

CVE-2019-10459

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

Cross site scripting

In FusionPBX up to v4.5.7, the file app\contacts\contacturls.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS...

PT-2019-14899 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns the use of an unsanitized id variable in the contact urls.php file, which is reflected in HTML. This leads to a potential XSS issue. Recommendations: For FusionPBX versions pri...

DEBIAN-CVE-2019-17670

WordPress before 5.2.4 has a Server Side Request Forgery SSRF vulnerability because Windows paths are mishandled during certain validation of relative URLs...

Denial Of Service

OpenJDK is vulnerable to denial of service DoS. It is due to an incorrect handling of nested jar: URLs in Jar URL handler...

CVE-2019-17670

WordPress before 5.2.4 has a Server Side Request Forgery SSRF vulnerability because Windows paths are mishandled during certain validation of relative URLs...

CVE-2019-15260

A vulnerability in Cisco Aironet Access Points APs Software could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device with elevated privileges. The vulnerability is due to insufficient access control for certain URLs on an affected device. An attacker could...

Improper access control

A vulnerability in Cisco Aironet Access Points APs Software could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device with elevated privileges. The vulnerability is due to insufficient access control for certain URLs on an affected device. An attacker could...