Cross site request forgery (csrf)

A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser...

CVE-2013-0196

A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser...

CVE-2019-19703

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location...

CVE-2019-19703

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location...

CVE-2019-19703

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location...

CVE-2019-19703: URL Redirection to Untrusted Site

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location...

PT-2019-15921

Name of the Vulnerable Software and Affected Versions Ktor versions prior to 1.3.0 Description The issue concerns the client resending data from the HTTP Authorization header to a redirect location. Recommendations For versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue...

EulerOS 2.0 SP3 : python-urllib3 (EulerOS-SA-2019-2239)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.CVE-2019-1123...

Regular Expression Denial Of Service (ReDoS)

webrick is vulenrable to regex denial of service. An attacker is able to crash the application by submitting malicious strings within the Authorization header to the authentication module...

EulerOS 2.0 SP5 : python-urllib3 (EulerOS-SA-2019-1877)

According to the version of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that diffe...

EulerOS 2.0 SP5 : python-requests (EulerOS-SA-2019-1886)

According to the version of the python-requests package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - python-requests: Redirect from HTTPS to HTTP does not remove Authorization header CVE-2018-18074 Note that Tenable Network Security has...

openSUSE: Security Advisory for python-urllib3 (openSUSE-SU-2019:2131-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2019:2131-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: Security issues fixed: - CVE-2019-9740: Fixed CRLF injection issue bsc1129071. - CVE-2019-11324: Fixed invalid CA certificat verification bsc1132900. - CVE-2019-11236: Fixed CRLF injection via request parameter bsc1132663. - CVE-2018-2006...

Security update for python-urllib3 (moderate)

openSUSE Security Update: Security update for python-urllib3 Announcement ID: openSUSE-SU-2019:2131-1 Rating: moderate References: 1119376 1129071 1132663 1132900 Cross-References: CVE-2018-20060 CVE-2019-11236 CVE-2019-11324 CVE-2019-9740 Affected Products: openSUSE Leap 15.0 An update that fixe...

SUSE-SU-2019:2370-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: Security issues fixed: - CVE-2019-9740: Fixed CRLF injection issue bsc1129071. - CVE-2019-11324: Fixed invalid CA certificat verification bsc1132900. - CVE-2019-11236: Fixed CRLF injection via request parameter bsc1132663. - CVE-2018-2006...

SUSE-SU-2019:2331-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: Security issues fixed: - CVE-2019-9740: Fixed CRLF injection issue bsc1129071. - CVE-2019-11324: Fixed invalid CA certificat verification bsc1132900. - CVE-2019-11236: Fixed CRLF injection via request parameter bsc1132663. - CVE-2018-2006...

SUSE-SU-2019:2300-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: Security issues fixed: - CVE-2019-9740: Fixed CRLF injection issue bsc1129071. - CVE-2019-11324: Fixed invalid CA certificat verification bsc1132900. - CVE-2019-11236: Fixed CRLF injection via request parameter bsc1132663. - CVE-2018-2006...

python security update

CentOS Errata and Security Advisory CESA-2019:2272 An update for python-urllib3 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

BCM Messenger: IDOR leading to downloading of any attachment

Description: Hey team, I came across an endpoint on your android app which could be used to download any attachment which is being uploaded onto your server. All the attacker needs to do is bruteforce the simple ID which surprisingly is a randomly generated number I personally think it's based on...

python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...