1024 matches found
Debian: Security Advisory (DLA-860-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2017-7839
Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting self-XSS attacks where users are...
UBUNTU-CVE-2017-7839
Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting self-XSS attacks where users are...
Debian DSA-4031-1 : ruby2.3 - security update
Several vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2017-0898 aerodudrizzt reported a buffer underrun vulnerability in the sprintf method of the Kernel module resulting in...
Escape sequence injection vulnerability in the Basic authentication of WEBrick
There is an escape sequence injection vulnerability in the Basic authentication of WEBrick bundled by Ruby. When using the Basic authentication of WEBrick, clients can pass an arbitrary string as the user name. WEBrick outputs the passed user name intact to its log, then an attacker can inject...
Legal Robot: Null Byte Injection in all fields of Profile
Hi Team, Null byte injection is possible in all the fields of Edit Profile functionality. Affected URL: https://app.legalrobot.com/account Description: Possible Injection of control characters, such as Null Byte 0x00, \000, \x00, \z, or the Unicode representation \u0000 into vulnerable fields in...
Legal Robot: Meta characters are not filtered into full name on profile page
A security researcher discovered that ASCII control characters were allowed in the user's profile fields. A simple change now strips these characters from fields like First Name, Last Name, etc...
Fedora 26 : wordpress (2017-2ae4a42cd4)
WordPress 4.7.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.7.2 and earlier are affected by six security issues : - Cross-site scripting XSS via media file metadata. Reported by Chris...
NfSen 1.3.7 / AlienVault USM/OSSIM 5.3.4 Command Injection
Exploit Title: NfSen/AlienVault remote root exploit IPC query command injection Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault 5.3.4 Date: 2017-07-10 Vendor Homepage: http://nfsen.sourceforge.net/ Vendor Homepage:...
MGASA-2017-0104 Updated wget packages fix security vulnerability
Wget up untill version 1.19.1 does not ensure control characters are not used in the hostname part of a url. This security update rejects control characters in host part of a url...
Updated wget packages fix security vulnerability
Wget up untill version 1.19.1 does not ensure control characters are not used in the hostname part of a url. This security update rejects control characters in host part of a url...
SUSE-SU-2017:0799-1 Security update for wget
This update for wget fixes the following issues: Security issue fixed: - CVE-2017-6508: urlparse: Reject control characters in host part of URL bsc1028301...
SUSE-SU-2017:0800-1 Security update for wget
This update for wget fixes the following issues: Security issue fixed: - CVE-2017-6508: urlparse: Reject control characters in host part of URL bsc1028301...
Rockstar Games: Profile bio at rockstar is accepting control characters
This report involved the injection of control characters, such as Null Byte 0x00, into the profile Bio field in order to cause unexpected, harmful behaviors. Our solution was to both block control characters from being saved on the backend when included in user-input, as well as to suppress the...
Fedora 24 : wordpress (2017-7e0b84ffad)
WordPress 4.7.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.7.2 and earlier are affected by six security issues : - Cross-site scripting XSS via media file metadata. Reported by Chris...
Input validation
In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...
DEBIAN-CVE-2017-6815
In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...
CVE-2017-6815
In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...