CVE-2016-5424

PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a 1 " double quote, 2 \ backslash, 3 carriage return, or 4 newline character ...

DSA-3646-1 postgresql-9.4 - security update

Bulletin has no description...

PostgreSQL -- Denial-of-Service and Code Injection Vulnerabilities

PostgreSQL project reports: Security Fixes nested CASE expressions + database and role names with embedded special characters CVE-2016-5423: certain nested CASE expressions can cause the server to crash. CVE-2016-5424: database and role names with embedded special characters can allow code...

Mozilla Firefox Address Bar Forgery Vulnerability (CNVD-2016-06153)

Mozilla Firefox is an open source web browser; A security vulnerability in Mozilla Firefox's handling of the left-to-right and right-to-left character sets allows remote attackers to build malicious WEB pages that can be exploited to trick users into parsing them, which can spoof the contents of...

CVE-2016-5267

Mozilla Firefox before 48.0 on Android allows remote attackers to spoof the address bar via left-to-right characters in conjunction with a right-to-left character set...

CVE-2016-5267

Mozilla Firefox before 48.0 on Android allows remote attackers to spoof the address bar via left-to-right characters in conjunction with a right-to-left character set...

phpMyAdmin Double URL Decoding XSS Vulnerability (PMASA-2016-16) - Windows

phpMyAdmin is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

moorings.co.uk XSS vulnerability

Vulnerable URL:...

The vulnerability of the International Components for Unicode library allows a attacker to trigger a service failure or cause other adverse effects.

The vulnerability of the collator implementation i18n/ucol.cpp in the International Components for Unicode library is related to resource management errors. Exploiting this vulnerability may allow a malicious actor to cause service failures or other effects through a specially crafted sequence of...

The vulnerability of the Wireshark Network Protocol Analyzer software allows a remote attacker to compromise the accessibility of protected information.

A vulnerability exists in the readnewline function of the Catapult DCT2000 dissector in Wireshark, due to incorrect processing of the '\n' and '\r' characters. Exploiting this vulnerability allows malicious actors to cause service failures—such as insufficient buffer filling, related to a...

CVE-2016-5099

Cross-site scripting XSS vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special characters that are mishandled during double URL decoding...

Cross site scripting

Cross-site scripting XSS vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special characters that are mishandled during double URL decoding...

CVE-2016-0364

IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation feature for secure properties, which allows remote authenticated users to obtain sensitive information via vectors involving special characters...

Design/Logic Flaw

IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation feature for secure properties, which allows remote authenticated users to obtain sensitive information via vectors involving special characters...

CVE-2016-0364

IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation feature for secure properties, which allows remote authenticated users to obtain sensitive information via vectors involving special characters...

ownCloud: SMB User Authentication Bypass and Persistence

Authentication Bypass ================== The external user authentication app in OwnCloud does not properly authenticate against an SMB server. In it's current implementation, the file owncloud/apps/userexternal/lib/smb.php, line 46-47 uses the command smbclient -L //host/dummy -Uuser%pass, where...

Security Advisory - XSS Vulnerability in Huawei Public Cloud Solution

The Public Cloud Solution has a Cross-Site Scripting XSS vulnerability in volume backup service module. An attacker can insert special characters to modify server data. Vulnerability ID: HWPSIRT-2016-06017 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID:...

Adding a group as a reviewer fails when the group id contains special characters because is not encoded

h3. Summary Groups containing special characters e.g. or / cannot be added as Reviewers. h3. Steps to Reproduce Create a group with a special character in it in an external user directory e.g. JIRA or LDAP Synchronize the group to FishEye Add the groups as a reviewer to a review h3. Expected...

Pornhub: RCE Possible Via Video Manager Export using @ character in Video Title

The researcher identified that it was possible to inject arbitrary characters into video titles, that when exported via video manager would result in client-side code execution. The researcher was successful in getting a pingback from a meterpreter shell on the victim's machine. Essentially using...

Python Injection of Arbitrary HTTP Headers Vulnerability

Python is an open source, object-oriented programming language. Python's urrlib2/urllib/httplib/http.client file 'HTTP Connection.putheader' function uses insecure characters that allow remote attackers to exploit vulnerabilities to inject arbitrary HTTP headers for spoofing attacks...