The vulnerability of the Internet Explorer browser, related to insecure management of privileges, allows attackers to partially compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Internet Explorer browser is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to partially compromise the confidentiality, integrity, and accessibility of protected information through a specially created URL address...

CVE-2018-1939

IBM Cloud Private 3.1.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site...

CVE-2019-6228

A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue is fixed in iOS 12.1.3, Safari 12.0.3. Processing maliciously crafted web content may lead to a cross site scripting attack...

The vulnerability of the Microsoft Office suite arises from security flaws in the way URLs are checked, allowing attackers to redirect users to malicious websites.

The vulnerability of the Microsoft Office suite is related to deficiencies in security mechanisms when checking URL addresses. Exploiting this vulnerability allows a malicious actor to redirect users to a malicious website using a specially crafted file...

CVE-2018-16493

A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL...

PT-2019-8300 · Pylons · Pylons Colander

Name of the Vulnerable Software and Affected Versions: Pylons Colander versions prior to 1.7 Description: The issue allows an attacker to potentially cause a denial of service via an unclosed parenthesis in the URL validator, which can lead to an infinite loop. Recommendations: For versions prior...

CVE-2018-15136

TitanHQ SpamTitan before 7.01 has Improper input validation. This allows internal attackers to bypass the anti-spam filter to send malicious emails to an entire organization by modifying the URL requests sent to the application...

PYSEC-2019-113

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI...

Cisco Small Business RV320 and RV325 Information Disclosure Vulnerabilities

The Cisco Small Business RV320 and RV325 are both enterprise-class routers from Cisco USA. An information disclosure vulnerability exists in the web-based management interface of the Cisco Small Business RV320 and RV325 using firmware versions 1.4.2.15 through 1.4.2.19. The vulnerability stems fr...

The vulnerability of the Mozilla Firefox browser, related to insufficient validation of input data when using full-screen mode, allows attackers to perform spoofing attacks.

The vulnerability of the Mozilla Firefox browser is related to insufficient validation of input data when using full-screen mode. Exploiting this vulnerability allows a malicious actor to perform spoofing attacks by replacing the page or URI...

The vulnerability of the Taserver web service on the TeNIX operating system for programmable logic controllers MFC1500 and MFC3000 allows a perpetrator to execute arbitrary code.

The vulnerability of the TAserver web service for the TeNIX programmable logic controllers MFC1500 and MFC3000 lies in the lack of name filtering when generating a 404 HTTP error page. As a result, the name of the non-existent web page is passed unchanged to the generated error page. Exploiting...

Pivotal Concourse Token Disclosure Vulnerability

Pivotal Concourse is a software delivery control system for continuous development from Pivotal Software. A security vulnerability exists in Pivotal Concourse versions prior to 4.2.2, which originates when the program places a user's access token in a URL. A remote attacker can exploit this...

CVE-2018-6133

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name...

UBUNTU-CVE-2018-6163

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name...

GNU Wget Information Disclosure Vulnerability

GNU Wget is a set of free software developed by the GNU Project for downloading over the Internet, which supports downloading over the three most common TCP/IP protocols: HTTP, HTTPS, and FTP. A security vulnerability in the 'setfilemetadata' function of the xattr.c file in versions of GNU Wget...

DEBIAN-CVE-2018-20483

setfilemetadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information e.g., credentials contained in the URL by reading this attribut...

ALPINE-CVE-2018-20483

setfilemetadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information e.g., credentials contained in the URL by reading this attribut...

TRENDnet TV-IP110WN and TV-IP121WN BoF Vulnerabilities

The TRENDnet TV-IP110WN is a wireless Internet surveillance camera.The TRENDnet TV-IP121WN is an Internet camera solution for monitoring... A BoF vulnerability exists in the TRENDnet TV-IP110WN and TV-IP121WN. An attacker can use a POST request to deliver its payload to trigger the BoF...

Rendertron Cross-Site Scripting Vulnerability

Rendertron is Google's open source Chrome rendering solution designed to instantly render web pages. A bug in Rendertron 1.0.0 reports a reflected cross-site scripting vulnerability that can be exploited by an attacker via an invalid URL to conduct a cross-site scripting attack...

UBUNTU-CVE-2018-6098

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name...