ROS-20230315-01

Vulnerability in Mozilla Thunderbird email client related to notifications that are not displayed, when the browser is in full screen mode, allowing an attacker to trick the victim into visiting a malicious website and performing a spoofing attack. to visit a malicious website and perform a...

Description of the security update for SharePoint Server 2019: March 14, 2023 (KB5002358)

None None...

CVE-2023-26457

SAP Content Server - version 7.53, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. After successful exploitation, an attacker can read and modify some sensitive information but cannot delete the data...

CVE-2023-0021

Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed...

CVE-2023-0021

Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed...

Cross site scripting

Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed...

PT-2023-20650 · Sap · Sap Content Server

Name of the Vulnerable Software and Affected Versions: SAP Content Server version 7.53 Description: The issue results from insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting XSS vulnerability. After successful exploitation, an attacker can read and modify some...

PT-2023-15953 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver versions 700 through 750 Description: The issue is caused by insufficient encoding of user input, allowing an unauthenticated attacker to inject code. This can expose sensitive data, such as user id and password, and may lead to...

Debian: Security Advisory (DLA-563-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-355-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

curl: CVE-2023-27533: Telnet option IAC injection

A vulnerability existed in the CURLOPTTELNETOPTIONS option of the cURL library, which allowed an attacker to inject unintended TELNET commands to the telnet connection by escaping out of the telnet subnegotiation. This could allow the attacker to execute arbitrary OS commands on the target system...

CLSA-2023-1677791921 tar: Fix of CVE-2022-48303

CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...

keycloak: path traversal via double URL encoding

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. Thi...

Schneider Electric Modicon PLCs Insufficiently Protected Credentials (CVE-2017-6028)

An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding leaving them susceptible to sniffing. Sniffed credentials...

httpd: mod_proxy_ajp: Possible request smuggling

A flaw was found in the modproxyajp module of httpd. The connection is not closed when there is an invalid Transfer-Encoding header, allowing an attacker to smuggle requests to the AJP server, where it forwards requests...

Internet Bug Bounty: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields

A vulnerability was discovered in the HTTP request parsing of Node.js version 18.7.0 that allowed header fields to be incorrectly handled without carriage return line feed termination, enabling potential HTTP request smuggling...

Music Gallery Site 1.0 SQL Injection Vulnerability

Music Gallery Site - SQL Injection on page musiclist.php and parameter cid is vulnerable, application url is ?page=musiclist&cid=?. Any remote attacker can access this page to exploit the vulnerbility. CVE Assigned: CVE-2023-0938 mitre.org nvd.nist.org Author Name: Muhammad Navaid Zafar Ansari...

Denial Of Service (DoS)

firefox is vulnerable to Denial Of Service DoS. The vulnerability exists when encoding data from an inputStream in xpcom. The input size being encoded was not correctly calculated, potentially leading to an out-of-bounds memory write, allowing an attacker to cause an application crash...

Braintree sanitize-url 跨站脚本漏洞

Braintree sanitize-url is an open source URL cleanup from Braintree USA. A security vulnerability exists in Braintree sanitize-url prior to version 6.0.2, which stems from allowing XSS attacks via HTML entities...

Siemens SCALANCE X-200RNA Switch Devices Improper Encoding or Escaping of Output (CVE-2019-6109)

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The- Middle attacker can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This...