12501 matches found
Security Bulletin: [All] Apache Tomcat (core only) (Publicly disclosed vulnerability) CVE-2020-1935, CVE-2019-17569
Summary In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a...
USN-4434-1 libvncserver vulnerabilities
Ramin Farajpour Cami discovered that LibVNCServer incorrectly handled certain malformed unix socket names. A remote attacker could exploit this with a crafted socket name, leading to a denial of service, or possibly execute arbitrary code. CVE-2019-20839 It was discovered that LibVNCServer did no...
RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack
A cross-site scripting XSS flaw was found in RESTEasy, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack...
SAP Process Integration PI Rest Adapter Cross-Site Scripting Vulnerability
SAP Process Integration is a middleware provided by SAP Germany that enables SAP to seamlessly integrate with non-SAP applications in the company or with systems external to the company. A cross-site scripting vulnerability exists in SAP Process Integration PI Rest Adapter. The vulnerability stem...
GNU LibreDWG Resource Management Error Vulnerability
GNU LibreDWG is a GNU Project C library for working with DWG files. A resource management error vulnerability exists in the 'dwgencodeLWPOLYLINE' function of the dwg.spec file in GNU LibreDWG version 0.9.3 and earlier. The vulnerability stems from mismanagement of system resources e.g., memory,...
Security update for rubygem-puma (moderate)
openSUSE Security Update: Security update for rubygem-puma Announcement ID: openSUSE-SU-2020:1001-1 Rating: moderate References: 1172175 1172176 Cross-References: CVE-2020-11076 CVE-2020-11077 Affected Products: openSUSE Leap 15.2 An update that fixes two vulnerabilities is now available...
Security update for rubygem-puma (moderate)
openSUSE Security Update: Security update for rubygem-puma Announcement ID: openSUSE-SU-2020:0990-1 Rating: moderate References: 1172175 1172176 Cross-References: CVE-2020-11076 CVE-2020-11077 Affected Products: openSUSE Leap 15.1 An update that fixes two vulnerabilities is now available...
Debian DLA-2280-1 : python3.5 security update
Multiple security issues were discovered in Python, an interactive high-level object-oriented language. CVE-2018-20406 Modules/pickle.c has an integer overflow via a large LONGBINPUT value that is mishandled during a 'resize to twice the size' attempt. This issue might cause memory exhaustion, bu...
U.S. Dept Of Defense: Reflected XSS in https://www.██████/
Hello Security Team, I would like to report the XSS vulnerability on your system. The i= parameter is not escaped properly for URL encoded values. Steps To Reproduce: Visit the following POC link:...
Code injection
Inappropriate Encoding for output context vulnerability in McAfee Web Gateway MWG prior to 9.2.1 allows a remote attacker to cause MWG to return an ambiguous redirect response via getting a user to click on a malicious URL...
CVE-2020-7292 Web Gateway (MWG) - Inappropriate Encoding for output context
Inappropriate Encoding for output context vulnerability in McAfee Web Gateway MWG prior to 9.2.1 allows a remote attacker to cause MWG to return an ambiguous redirect response via getting a user to click on a malicious URL...
CVE-2020-7292
CVE-2020-7292 affects McAfee Web Gateway (MWG) prior to version 9.2.1. The issue is an Inappropriate Encoding for Output Context , which can allow a remote attacker to cause MWG to return an ambiguous redirect response when a user clicks a malicious URL. The vulnerability is rooted in the output ...
U.S. Dept Of Defense: RXSS - ████
Hello, friends today when I was checking some sites I found this bug on your own website. Detalis XSS Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web...
CVE-2020-6281
SAP Business Objects Business Intelligence Platform BI Launchpad, version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in Cross-Site Scripting...
CVE-2020-6276
SAP Business Objects Business Intelligence Platform bipodata, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability...
Information Disclosure
django-two-factor-auth is vulnerable to information disclosure. The vulnerability exists as it stores the user's password in the user session with base64-encoded clear text...
Log Injection
Overview uvicorn is a lightning-fast ASGI server. Affected versions of this package are vulnerable to Log Injection. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its...
CVE-2020-12409
When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. This vulnerability affects Firefox 77...
