CVE-2020-28493

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to...

CVE-2020-28493

CVE-2020-28493 affects jinja2 up to version 2.11.3 (inclusive of 0.0.0 to before 2.11.3). The root cause is a Denial of Service likely caused by the regex in the _punctuation_re used by the urlize filter, leading to excessive CPU on crafted input. Public documents identify this ReDoS vulnerabilit...

CVE-2020-28493

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to...

CVE-2020-13314

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be displayed back to the user within error messages...

The vulnerability of the Cisco IOS XE operating system, related to errors in checking the content provided by users, allows a hacker to elevate their privileges to the root level.

The vulnerability of the Cisco IOS XE operating system is related to errors during the verification of content provided by users. Exploiting this vulnerability can allow attackers to elevate their privileges to the root level...

Cisco IOS XE Privilege Permission and Access Control Issues Vulnerability (CNVD-2020-31964)

Cisco IOS XE is the United States Cisco Cisco company's set of operating system developed for its network equipment. A privilege-granting and access-control issue vulnerability exists in Cisco IOS XE, which arises from a program that does not adequately validate user-supplied content. A local...

GHSA-2RXH-H6H9-QRQC Class destructors causing side-effects when being unserialized in TYPO3 CMS

Calling unserialize on malicious user-submitted content can result in the following scenarios: - trigger deletion of arbitrary directory in file system if writable for web server - trigger message submission via email using identity of web site mail relay Another insecure deserialization...

User content can redirect the logout button to different URL

More info at https://phabricator.wikimedia.org/T232932...

SQL Injection in low-level Query Generator

Failing to properly escape user submitted content, class QueryGenerator is vulnerable to SQL injection...

FaceApp scares point to larger data collection problems

Last week, if you thumbed your way through Facebook, Instagram, and Twitter, you likely saw altered photos of your friends with a few extra decades written onto their faces—wrinkles added, skin sagged, hair bereft of color. Has 2019 really been that long? Not really. The photos are the work of...

CVE-2018-16622

Multiple cross-site scripting XSS vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 discription or 2 comments field, related to users/userAddContent...

Apache HTTP Server Multiple Vulnerabilities (Apr 2018) - Linux

Apache HTTP Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:httpserver"; if...

Adobe Flash Player Arbitrary Code Execution Vulnerability (CNVD-2018-07047)

Adobe Flash Player is a widely used, proprietary multimedia program player. An arbitrary code execution vulnerability exists in Adobe Flash Player due to improper handling of user-loaded content by Adobe Flash Player. An attacker can achieve arbitrary code execution by creating specially crafted...

Indexable User Content (Attachments) on Google

User content uploaded onto answers.atlassian.com is indexable by Google due to the lack of appropriate indexing rules such as those in /robots.txt. Additionally, such content being indexed can be removed from Google by consulting Google's Webmaster tools. An example of indexable content is below:...

Indexable User Content (Attachments) on Google

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47021. panel User content uploaded onto answers.atlassian.com is indexable by Google due to the lack of appropriate indexing rul...

Indexable User Content (Attachments) on Google

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-47021. panel User content uploaded onto answers.atlassian.com is indexable by Google due to the lack of appropriate indexing...

Indexable User Content (Attachments) on Google

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47021. panel User content uploaded onto answers.atlassian.com is indexable by Google due to the lack of appropriate indexing rul...

Microsoft Disclosed User Content in 10% of U.S. Law Enforcement Requests

Microsoft supplied user content in response to 10.8 percent of the law enforcement requests it received from United States agencies in the second half of 2013. The company got more than 5,600 requests from U.S. agencies in the last six months of the year, and in the vast majority of those–68...

Microsoft Transparency Report Shows Company Supplied User Content in 2.2% of Cases

Microsoft received more than 11,000 requests for user information or content data from law enforcement agencies in the United States last year and supplied some user content in more than 1,500 of those cases. Overall, the company received more than 70,000 requests from law enforcement agencies...

Dradis v2.6 - Tool for sharing information during security testing !

"Dradis is a tool for sharing information during security testing. While plenty of tools exist to help in the different stages of the test, not so many exist to share interesting information captured. When a team of testers is working on the same set of targets, having a common repository of...