CVE-2019-11720

Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed, evading cross-site scripting XSS filtering. This vulnerability affects Firefox 68...

Cleartext Message Spoofing

github.com/golang/crypto is vulnerable to cleartext message spoofing. A remote attacker is able to spoof parts of the message via malicious messages containing control or unicode characters, to trick a user into performing an undesired action...

Cross-site Scripting (XSS)

jetty-util is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the directory listing does not encode characters in UTF-8, allowing a remote attacker to inject arbitrary Javascript into a victim's browser through unicode characters...

PHP 7.1.x < 7.1.6 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.6. It is, therefore, affected by the following vulnerabilities : - A flaw exists in zendhashaddorupdatei within file main/phpini.c when handling a malformed php.ini file. An attacker can exploit thi...

CVE-2018-4277: a“pie”triggered spoofing-vulnerability warning-the black bar safety net

Researchers looking for the browser front-end security issues found in Chrome, Safari, Firefox and other browsers there is a security vulnerability. This article describes Apple products Alphabet d-shaped problems caused by domain spoofing problem. U+A771 The researchers found that Apple products...

CVE-2018-9452

In getOffsetForHorizontal of Layout.java, there is a possible application hang due to a slow width calculation. This could lead to remote denial of service if a contact with many hidden unicode characters were sent to the device and used by a local app, with no additional execution privileges...

Code injection

In getOffsetForHorizontal of Layout.java, there is a possible application hang due to a slow width calculation. This could lead to remote denial of service if a contact with many hidden unicode characters were sent to the device and used by a local app, with no additional execution privileges...

Response Splitting

node.js is vulnerable to response splitting. The library does not handle unicode characters properly, allowing a malicious user to conduct a response splitting attack...

Mozilla Firefox ESR < 52.4 Multiple Vulnerabilities

Binary data 700331.prm...

Denial Of Service (DoS)

ASP.NET Core is vulnerable to a denial of service vulnerability. This is due to the way HTML Encoder processes unicode characters when performing encoding, which results in an exception...

Open-Xchange (OX) App Suite Content Spoofing Vulnerability (Jun 2018)

Open-Xchange OX App Suite is prone to a content spoofing vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2018-5753

Open-Xchange OX App Suite contains a content spoofing vulnerability in the frontend component that allows remote attackers to spoof the origin of emails by using Unicode in the personal part of the From or Sender address. Affected versions include 7.6.3-rev31 and earlier for 7.6.x, 7.8.x prior to...

CVE-2018-5173

The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full,...

Open redirect

The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full,...

CVE-2018-5173

The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full,...

CVE-2018-5173

The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full,...

Mozilla Firefox Filename Spoofing Vulnerability

Mozilla Firefox browser Firefox is a free and open source browser for Windows, Linux and MacOSX platforms. A filename spoofing vulnerability exists in Mozilla Firefox in the Download panel. A remote user can use Unicode characters to spoof filenames in the Download panel...

CVE-2018-5173

The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full,...

CVE-2018-10799

A hang issue was discovered in Brave before 0.14.0 on, for example, Linux. This vulnerability is caused by the mishandling of a long URL formed by window.location+='?\u202a\uFEFF\u202b'; concatenation in a SCRIPT element...

Look-Alike Domains and Visual Confusion

How good are you at telling the difference between domain names you know and trust and impostor or look-alike domains? The answer may depend on how familiar you are with the nuances of internationalized domain names IDNs, as well as which browser or Web application you're using. For example, how...