6446 matches found
PT-2022-28190 · Varnish · Varnish Cache
Name of the Vulnerable Software and Affected Versions: Varnish Cache versions prior to 6.0.11 Description: A request forgery attack can be performed on Varnish Cache servers with the HTTP/2 protocol enabled. An attacker may introduce invalid characters through HTTP/2 pseudo-headers, causing the...
Cross-site Scripting (XSS)
silverstripe/framework is vulnerable to cross-site scripting. The vulnerability exists in the sanitise function of HTMLEditorSanitiser.php because of uppercase characters in HTMLEditor which allows an attacker to inject and execute malicious JavaScript...
jaguar-etype.nl Cross Site Scripting vulnerability OBB-3067160
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-37429
Silverstripe silverstripe/framework through 4.11 allows XSS issue 1 of 2 via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters...
xterm: Arbitrary Code Execution
Background xterm is a terminal emulator for the X Window system. Description xterm does not correctly handle control characters related to OSC 50 font ops sequence handling. Impact The vulnerability allows text written to the terminal to write text to the terminal's command line. If the terminal'...
November 22, 2022—KB5020032 (OS Build 20348.1311) Preview
None None...
D-Link DIR-823G 操作系统命令注入漏洞
D-Link DIR-823G is a wireless router from D-Link, a Chinese company. D-Link DIR-823G firmware version 1.02B05 contains a command execution vulnerability that stems from sub42383C's failure to properly filter constructed command special characters, commands, etc. The vulnerability can be exploited...
Stored XSS using HTMLEditor
A malicious content author could add a JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters. An attacker must have access to the CMS to exploit this issue...
Apache Airflow code injection vulnerability
Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform is scalable and dynamic monitoring features. Apache Airflow has a code injection vulnerability, the vulnerability stems from the user input structure during the...
OpenSSL c_rehash Script Command Injection (CVE-2022-1292)
A command injection vulnerability has been reported in the OpenSSL. The vulnerability is due to improper validation of input characters. Successful exploitation could result in command execution within the context of the target user...
EulerOS 2.0 SP9 : python-pip (EulerOS-SA-2022-2740)
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a...
lj-batiment.fr Cross Site Scripting vulnerability OBB-3049347
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
FreeBSD : varnish -- HTTP/2 Request Forgery Vulnerability (5b8d8dee-6088-11ed-8c5e-641c67a117d8)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5b8d8dee-6088-11ed-8c5e-641c67a117d8 advisory. - Varnish Cache Project reports: A request forgery attack can be performed on Varnish Cache servers tha...
RHEL 8 : mingw-expat (RHSA-2022:7811)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7811 advisory. Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat library for MinGW. The following packag...
netty: control chars in header names may lead to HTTP request smuggling
A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling...
netty: control chars in header names may lead to HTTP request smuggling
A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling...
netty: control chars in header names may lead to HTTP request smuggling
A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling...
netty: control chars in header names may lead to HTTP request smuggling
A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling...
