UBUNTU-CVE-2018-5112

Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension manifest file but this requirement was not enforced in all instances. This could allow the development tools panel for the extension to load a URL that it should not be able to...

CVE-2017-16787

The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure to restrict URL access...

FTP wildcard out of bounds read

libcurl contains a read out of bounds flaw in the FTP wildcard function. libcurl's FTP wildcard matching feature, which is enabled with the CURLOPTWILDCARDMATCH option can use a built-in wildcard function or a user provided one. The built-in wildcard function has a flaw that makes it not detect t...

UBUNTU-CVE-2017-7830

The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox 57, Firefox ESR 52.5, and Thunderbird 52.5...

Logitech Media Server Cross-Site Scripting Vulnerability

Logitech Media Server is an audio playback software from Logitech USA. A cross-site scripting vulnerability exists in Logitech Media Server. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML using specially crafted URIs...

xmlsec1: xmlsec vulnerable to external entity expansion

It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion XXE along with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files or HTTP/FTP URLs, leading to information disclosure or denial of service...

OpenJDK: LDAPCertStore following referrals to non-LDAP URLs (Security, 8176067)

It was discovered that the LDAPCertStore class in the Security component of OpenJDK followed LDAP referrals to arbitrary URLs. A specially crafted LDAP referral URL could cause LDAPCertStore to communicate with non-LDAP servers...

Mozilla Firefox Address Bar Spoofing Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. An address bar spoofing vulnerability exists in Reader mode in versions of Mozilla Firefox prior to 54, which originates from displaying partial usernames and passwords in URLs. A remote attack...

Magento Cross-Site Request Forgery Vulnerability

Magento is an open source PHP e-commerce system from the U.S. company Magento. Magento suffers from a cross-site request forgery vulnerability. A remote user can create specially crafted HTML pages or URLs that, when loaded by a target authenticated user, will take action against the target...

chromium-browser: incorrect handling of cookies in cast

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent...

CVE-2016-5953

IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL...

The vulnerability of Google Chrome browser allows a perpetrator to trigger a service failure or otherwise affect the system.

The vulnerability of Google Chrome is related to insufficient cleaning of URLs in DevTools. Exploiting this vulnerability can allow a malicious actor to cause service failures or other effects on the system through a specially created HTML page...

UBUNTU-CVE-2017-5383

URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird 45.7, Firefox ESR 45.7, and Firefox 51...

Mozilla Firefox is vulnerable

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. Mozilla Firefox has a security vulnerability. Allow SSL indicators may mislead users about the real URLs visited. Note: This issue only affects Firefox for Android. Desktop Firefox is not...

Lynx URL Redirection Vulnerability

Lynx is a text-only web browser. Lynx has a redirection vulnerability that can be exploited to construct malicious URIs, trick users into parsing them, and redirect them to arbitrary web sites for phishing attacks...

foreman: API and UI actions/URLs not limited to the orgs/locations assigned

It was found that the foreman API and UI actions and URLs are not properly limited to the organizations and locations they were assigned to. This could allow an attacker to view and update other organizations and locations in the system that they should not be allowed to...

WordPress SSRF Vulnerability

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress versions prior to 4.5, which stems from the program ignoring oct...

CVE-2016-0393

IBM Maximo Asset Management 7.5 before 7.5.0.10-TIV-MBS-IFIX002 and 7.6 before 7.6.0.5-TIV-MAMMT-FP001 allows remote attackers to obtain sensitive URL information by reading log files...

Microsoft Internet Explorer Spoofing Vulnerability (CNVD-2016-04956)

Microsoft Internet Explorer IE and Microsoft Edge are both web browsers developed by the American company Microsoft. The former is the default browser that came with operating systems before Windows 10, and the latter is the default browser that comes with the latest operating system, Windows 10....

The vulnerability of Apache Subversion software allows a malicious intruder to compromise the confidentiality and integrity of protected information.

Vulnerability exists in Apache Subversion due to the storage of cached user credentials, based on MD5 hashes of URL addresses and authentication realms. Exploiting this vulnerability allows remote servers to gain access to user credentials by using a specially crafted authentication realm...