PT-2021-14725 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.314 and earlier Jenkins LTS versions 2.303.1 and earlier Description: The issue arises from Jenkins accepting names of jobs and other entities with a trailing dot character on Windows, potentially allowing users with...

Open Redirect

Overview rails is an opensource MVC web framework. Affected versions of this package are vulnerable to Open Redirect. Specially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a...

vsftpd 3.0.3 Denial Of Service

Exploit Title: vsftpd 3.0.3 - Remote Denial of Service Date: 22-03-2021 Exploit Author: xynmaps Vendor Homepage: https://security.appspot.com/vsftpd.html Software Link: https://security.appspot.com/downloads/vsftpd-3.0.3.tar.gz Version: 3.0.3 Tested on: Parrot Security OS 5.9.0...

UBUNTU-CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

GHSA-69RR-WVH9-6C4Q Directory Traversal in st

Versions of st prior to 0.2.5 are affected by a directory traversal vulnerability. Vulnerable versions fail to properly handle URL encoded dots, which caused %2e to be interpreted as . by the filesystem, resulting the potential for an attacker to read sensitive files on the server. Recommendation...

CorsMe - Cross Origin Resource Sharing MisConfiguration Scanner

A Misconfiguration Scanner cors misconfiguration scanner tool based on golang with speed and precision in mind ! Misconfiguration type thisscanner can check for Reflect Origin checks Prefix Match Suffix Match Not Esacped Dots Null ThirdParties Like = github.io, repl.it etc. Taken from Chenjj's...

UBUNTU-CVE-2020-7668

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

DRUPAL-CORE-2019-010

Drupal 8 core's filesaveupload function does not strip the leading and trailing dot '.' from filenames, like Drupal 7 did. Users with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to...

CVE-2019-13464

An issue was discovered in OWASP ModSecurity Core Rule Set CRS 3.0.2. Use of X.Filename instead of XFilename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid...

May 29, 2019—KB4497935 (OS Build 18362.145)

None None...

Serverxxx Directory Traversal Vulnerability

serverxxx is a static file server. A directory traversal vulnerability exists in serverxxx. An attacker can gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

CVE-2018-11486

An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-site scripting XSS vulnerability. A non-authenticated user can save the plugin settings and inject malicious JavaScript code in the Custom CS...

lots-of-dots.pl XSS vulnerability

Vulnerable URL: http://lots-of-dots.pl/zaawansowaneszukaniewyniki.php?keywords=1%22--!%3E%3CSvg/OnLoad=confirm1%3E%[email protected] Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unkno...

Two Dots - Customized SSL, Redefined SSL Common Names verifier, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Two Dots published at the 'play' market has multiple vulnerabilities...

DEBIAN-CVE-2016-5427

PowerDNS aka pdns Authoritative Server before 3.4.10 does not properly handle a . dot inside labels, which allows remote attackers to cause a denial of service backend CPU consumption via a crafted DNS query...

ALPINE-CVE-2016-1238

1 cpan/Archive-Tar/bin/ptar, 2 cpan/Archive-Tar/bin/ptardiff, 3 cpan/Archive-Tar/bin/ptargrep, 4 cpan/CPAN/scripts/cpan, 5 cpan/Digest-SHA/shasum, 6 cpan/Encode/bin/enc2xs, 7 cpan/Encode/bin/encguess, 8 cpan/Encode/bin/piconv, 9 cpan/Encode/bin/ucmlint, 10 cpan/Encode/bin/unidump, 11...

Connect the dots for children - Base64 encoded String, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Connect the dots for children published at the 'play' market has multiple vulnerabilities...

Christmas Coloring Dots Games - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Christmas Coloring Dots Games published at the 'play' market has multiple vulnerabilities...

Color Match: Dots - SD-card access, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Color Match: Dots published at the 'play' market has multiple vulnerabilities...

ABC Zoo Animal Connect Dots - External URLs vulnerabilities

HackApp vulnerability scanner discovered that application ABC Zoo Animal Connect Dots published at the 'play' market has multiple vulnerabilities...