SUSE CVE-2019-9209

In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preventing a buffer overflow associated with excessive digits in time values...

SUSE CVE-2019-11454

Persistent cross-site scripting XSS in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an...

SUSE CVE-2019-12527

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user...

SUSE CVE-2019-12529

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checki...

SUSE CVE-2020-6528

Incorrect security UI in basic auth in Google Chrome on iOS prior to 84.0.4147.89 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

SUSE CVE-2020-8553

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace ...

SUSE CVE-2021-3733

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client such as web browser connects to, could trigger a Regular Expression Denial of Service ReDOS during an authentication request with a specially crafted payload that is sen...

SUSE CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

SUSE CVE-2022-1343

The function OCSPbasicverify verifies the signer certificate on an OCSP response. In the case where the non-default flag OCSPNOCHECKS is used then the response will be positive meaning a successful verification even in the case where the response signing certificate fails to verify. It is...

CVE-2022-45755

Cross-site scripting XSS vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the basic information page...

CVE-2022-45755

Cross-site scripting XSS vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the basic information page...

PT-2023-14743

Name of the Vulnerable Software and Affected Versions EyouCMS version 1.6.0 Description A cross-site scripting XSS issue allows attackers to execute arbitrary code via the home page description on the basic information page. This can be exploited by manipulating the home page description variable...

EyouCMS cross-site scripting vulnerabilities

Zanzan Network Technology EyouCms EyouCMS is an open source content management system CMS based on ThinkPHP by China Zanzan Network Technology. A security vulnerability exists in EyouCMS v1.6.0. An attacker exploited the vulnerability to execute arbitrary code via the homepage description on the...

Post-Macro World Sees Rise in Microsoft OneNote Documents Delivering Malware

In a continuing sign that threat actors are adapting well to a post-macro world, it has emerged that the use of Microsoft OneNote documents to deliver malware via phishing attacks is on the rise. Some of the notable malware families that are being distributed using this method include AsyncRAT,...

CVE-2023-0612

A vulnerability, which was classified as critical, was found in TRENDnet TEW-811DRU 1.0.10.0. Affected is an unknown function of the file /wireless/basic.asp of the component httpd. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been...

PT-2023-16401 · Trendnet · Trendnet Tew-811Dru

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-811DRU version 1.0.10.0 Description: A critical issue was found in the httpd component, specifically in the /wireless/basic.asp file. The manipulation of the device web ip argument leads to buffer overflow. This issue can be...

TRENDnet TEW-811DRU security vulnerabilities

The TRENDnet TEW-811DRU is a wireless router from Trendnet, Inc. A security vulnerability exists in the TRENDnet TEW-811DRU version 1.0.10.0, which originates from an unknown function in the wireless/basic.asp file of the component httpd, resulting in a buffer overflow...

HP PC security vulnerabilities

HP PC is a computer product of Hewlett-Packard HP Company, USA. The HP PC has a security vulnerability that stems from a potential flaw in the BIOS UEFI firmware that could allow arbitrary code execution...

Stack overflow

Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these...

org.jenkins-ci.plugins.workflow:workflow-basic-steps (>=1017.vb_45b_302f0cea, <=1058.vcb_fc1e3a_21a_9), org.jenkins-ci.plugins.workflow:workflow-durable-task-step (>=1246.v5524618ea_097, <=1247.v7f9dfea_b_4fd0) potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1189.vb_a_b_7c8fd5fde)

org.jenkins-ci.plugins:script-security MAVEN version 1189.vbab7c8fd5fde is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-basic-steps...