Prototype Pollution

Overview fine-uploader is a npm package for upload. Note: This project is no longer maintained and the the package should be considered deprecated. Affected versions of this package are vulnerable to Prototype Pollution. Given a value such as proto, this value is used by the extend function witho...

Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability

A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system,...

Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability

A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system,...

OracleVM 3.4 : xen (OVMSA-2020-0027) (deprecated)

The remote OracleVM system is missing necessary patches to address critical security updates : - BUILDINFO: OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8 - BUILDINFO: xen commit=077233184260bd831e7c4afdd4aebb0bced6ee32 - BUILDINFO: QEMU upstream...

Red Hat curl local file overwrite (CVE-2020-8177) (deprecated)

This plugin has been deprecated by the RedHat distribution specific plugins 142705 and 142414. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2020/11/16. Deprecated by redhat-RHSA-2020-4599.nasl and redhat-RHSA-2020-5002.nasl. include'compat.inc'; if description scriptid138374;...

Command injection

In mversion before 2.0.0, there is a command injection vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This vulnerability is patched by version 2.0.0. Previous releases are deprecated in npm. As a workaround,...

Veeam Backup for Microsoft 365 Modern App-Only Authentication Limitations

Information Veeam Backup for Microsoft 365 v8 and higher Due to Microsoft's deprecation of Basic Authentication, the only option available when adding a new Microsoft 365 organization to Veeam Backup for Microsoft 365 v8 is Modern App-Only Authentication. Veeam Backup for Microsoft 365 v7 and v7a...

CVE-2020-7659

reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as...

CVE-2020-7659

reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as...

CVE-2020-7659

reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as...

CVE-2020-7659

reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as...

UBUNTU-CVE-2020-7659

reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as...

CVE-2020-7659

reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as...

CVE-2020-7659

The CVE-2020-7659 entry is supported by connected documents showing that Reel (version 0.6.1 and earlier) is vulnerable to HTTP request smuggling. The root cause is incorrect parsing of Content-Length and Transfer-Encoding headers, enabling smuggling by sending a duplicated Content-Length header ...

CVE-2020-7659

Removed by vendor...

HTTP Request Smuggling

Overview reel is a fast, non-blocking "evented" web server built on httpparser.rb, websocket-driver, Celluloid::IO, and nio4r. Note: This project is deprecated, and is not maintained anymore. Affected versions of this package are vulnerable to HTTP Request Smuggling. HTTP pipelining issues and...

WordPress: Arbitrary change of blog's background image via CSRF

Description: Despite being deprecated since v3.5.0, the wpsetbackgroundimage method defined in wp-admin/includes/class-custom-background.php, registered as an authenticated AJAX call wpajaxset-background-image, is still active. Given that the method is lacking CSRF checks, an attacker could chang...

Policy Compliance Library Updates, May 2020

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

Exploit for Deserialization of Untrusted Data in Rubyonrails Rails

CVE-2020-8165 Ruby on Rails For educational purposes only...

nginx <= 1.18.0 HTTP Request Smuggling Vulnerability

Deprecated since the CVE has been rejected: SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...