python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...

Symantec Endpoint Protection Manager Buffer Overflow Vulnerability

Symantec Endpoint Protection Manager SEPM is a suite of enterprise-grade virus protection software from Symantec USA. The software protects against malicious attacks such as viruses, worms, and Trojan horses. A buffer overflow vulnerability exists in Symantec SEPM versions prior to 14.3. The...

McAfee MVISION Endpoint Elevation of Privilege Vulnerability

McAfee MVISION Endpoint is a set of endpoint security protection software from the U.S. company McAfee McAfee. The software provides enhanced threat detection and correction for Windows systems. An elevation of privilege vulnerability exists in versions prior to McAfee MVISION Endpoint 20.5.0.94...

CVE-2018-5493

ATTO FibreBridge 7500N firmware versions prior to 2.90 are susceptible to a vulnerability which allows an unauthenticated remote attacker to cause Denial of Service DoS...

Cisco Firepower Device Manager On-Box Input Validation Error Vulnerability

Cisco Firepower Device Manager FDM is a firewall device manager from Cisco USA. The product supports access rule configuration, system monitoring, etc. Cisco Firepower Device Manager On-Box software is one of the built-in software. An input validation error vulnerability exists in Cisco FDM On-Bo...

Mozilla Thunderbird Access Control Error Vulnerability

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. An access control error vulnerability exists in Mozilla Thunderbird versions prior to...

Synology Router Manager Buffer Overflow Vulnerability

Synology Router Manager SRM is a software for configuring and managing Synology routers from Synology Inc. of Taiwan, China. A buffer overflow vulnerability exists in Network Center in Synology SRM versions prior to 1.2.3-8017-2, which can be exploited by remote attackers to cause a denial of...

Dell EMC RSA Archer Operating System Command Injection Vulnerability

Dell EMC RSA Archer is an enterprise IT governance and compliance governance product from Dell USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. An operating system command injection vulnerability exists in versions...

Microsoft Actions Http-Client Information Disclosure Vulnerability

Microsoft Actions Http-Client is the United States Microsoft Microsoft a lightweight HTTP client. An information disclosure vulnerability exists in Microsoft Actions Http-Client NPM @actions/http-client versions prior to 1.0.8. The vulnerability stems from a configuration or other error in the...

CVE-2020-8774

Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability in the "ActionStringID" function...

python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...

Croogo Cross-Site Scripting Vulnerability (CNVD-2020-33328)

Croogo is a content management system CMS based on the CakePHP framework development . The system provides content type can be customized for Blog, Node, Page, content editing using WYSIWYG editor and other features. A cross-site scripting vulnerability exists in versions prior to Croogo 3.0.7. T...

CVE-2020-6824

Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user had opened a new Private Browsing Window, revisited the same site, and generated a new password - the generated passwor...

CVE-2018-21108

NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user...

PT-2020-13029 · WordPress · Mappress-Google-Maps-For-Wordpress

Name of the Vulnerable Software and Affected Versions: mappress-google-maps-for-wordpress plugin versions prior to 2.53.9 Description: The issue arises from the incorrect implementation of AJAX functions with nonces or capability checks in the mappress-google-maps-for-wordpress plugin, leading to...

NETGEAR XR500 Code Execution Vulnerability

The NETGEAR XR500 is a wireless router from NETGEAR. A code execution vulnerability exists in NETGEAR XR500 versions prior to 2.3.2.32, which can be exploited by an attacker to execute code...

UBUNTU-CVE-2019-20787

Teeworlds before 0.7.4 has an integer overflow when computing a tilemap size...

NETGEAR ReadyNAS OS xss Vulnerability (CNVD-2020-74064)

NETGEAR ReadyNAS OS is a set of operating systems for ReadyNAS network attached storage devices from NETGEAR. A cross-site scripting vulnerability exists in NETGEAR ReadyNAS OS 6 versions prior to 6.8.0. The vulnerability stems from a lack of proper validation of client data by the WEB applicatio...

NETGEAR R7800 Buffer Overflow Vulnerability

The NETGEAR R7800 is a wireless router from NETGEAR. A buffer error vulnerability exists in the ETGEAR R7800 prior to version 1.0.2.52. The vulnerability stems from a network system or product performing operations on memory without properly validating data boundaries, resulting in incorrect read...

NETGEAR R9000 Cross-Site Scripting Vulnerability

The NETGEAR R9000 is a wireless router from NETGEAR. A cross-site scripting vulnerability exists in the NETGEAR R9000 prior to version 1.0.4.26, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute client-side code...