Cross Site Scripting (XSS)

Phlex is vulnerable to a cross-site scripting XSS. The vulnerability is due to improper case-sensitivity checks, rendering an tag with a user-provided link in the href attribute within the sgml.rb file, resulting in the execution of JavaScript when clicked on by another user...

Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex

There is a potential cross-site scripting XSS vulnerability that can be exploited via maliciously crafted user data. This was due to improper case-sensitivity in the code that was meant to prevent these attacks. Impact If you render an tag with an href attribute set to a user-provided link, that...

Cross site scripting

phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting XSS vulnerability that can be exploited via maliciously crafted user data. This was due to improper case-sensitivity in the code that was meant to prevent these attacks. If you...

CVE-2024-28199

Phlex (Ruby) contains an XSS vulnerability (CVE-2024-28199) due to case-sensitive checks not preventing malicious data in HTML attributes. If a user-provided href is rendered in an tag or if user attributes are splatted onto elements, JavaScript may execute in victims’ browsers. Patched versions...

CVE-2024-28199 Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex

phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting XSS vulnerability that can be exploited via maliciously crafted user data. This was due to improper case-sensitivity in the code that was meant to prevent these attacks. If you...

phlex Cross-Site Scripting Vulnerability

phlex is a framework for building object-oriented views in Ruby. A cross-site scripting vulnerability exists in versions prior to phlex 1.9.1, which stems from code that is not properly case-sensitive, resulting in cross-site scripting...

Authentication fails through Remote Power shell SDK

Authentication fails through Remote Power shell SDK whenupper case and lower case are present in the Customer ID...

PT-2023-25658 · Prolion · Prolion Cryptospike

Name of the Vulnerable Software and Affected Versions: ProLion CryptoSpike version 3.0.15P2 Description: The issue concerns the login REST API when using LDAP or Active Directory as the user store. It allows a remote blocked user to login and obtain an authentication token by specifying a usernam...

ProLion CryptoSpike Security Vulnerability

ProLion CryptoSpike is ProLion's solution for detecting and combating suspicious activity. A security vulnerability exists in ProLion CryptoSpike version 3.0.15P2, which stems from a vulnerability that allows a remotely blocked user to log in and obtain an authentication token by specifying a...

An issue was discovered in Qt before 5.15.14 6.x before 6.2.9 and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header allowing unencrypted connections to be established even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.

...

PT-2023-3581 · Qt Company +4 · Qt +4

Name of the Vulnerable Software and Affected Versions: Qt versions prior to 5.15.14 Qt versions 6.x prior to 6.2.9 Qt versions 6.3.x through 6.5.x prior to 6.5.1 Description: An issue in Qt Network incorrectly parses the strict-transport-security HSTS header, allowing unencrypted connections to b...

CVE-2022-29604

An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of case sensitivity causes inconsistency between intent and flow rules in the network...

Input validation

An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of case sensitivity causes inconsistency between intent and flow rules in the network...

PT-2023-12979 · Onos · Onos

Name of the Vulnerable Software and Affected Versions: ONOS version 2.5.1 Description: An issue was discovered in ONOS where an intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. This occurs due to improper handling of case...

CVE-2022-29604

An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of case sensitivity causes inconsistency between intent and flow rules in the network...

CVE-2022-29604

An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of case sensitivity causes inconsistency between intent and flow rules in the network...

CVE-2022-29604

An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of case sensitivity causes inconsistency between intent and flow rules in the network...

CVE-2022-29604

ONOS 2.5.1 is affected: an intent with an uppercase device ID can enter a CORRUPT state due to case-sensitivity mishandling, causing inconsistency between intent and flow rules. The connected documents reiterate the issue but do not provide a concrete fix or remediation details. No further exploi...

CVE-2023-29412

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause remote code execution when manipulating internal methods through Java RMI interface...

Design/Logic Flaw

A CWE-78: Improper Handling of Case Sensitivity vulnerability exists that could cause remote code execution when manipulating internal methods through Java RMI interface...