CVE-2020-15125

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

CVE-2020-15125 Authorization header is not sanitized in an error object in auth0

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

Information disclosure through error object in auth0.js

Overview Between versions 8.0.0 and 9.13.1inclusive, in the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification...

GHSA-PRFQ-F66G-43MP Information disclosure through error object in auth0.js

Overview Between versions 8.0.0 and 9.13.1inclusive, in the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification...

Design/Logic Flaw

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

CVE-2020-5263: Insufficiently Protected Credentials

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

ghostscript: Saved execution stacks can leak operator arrays

Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object...

CVE-2018-18073

Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object. Mitigation Please refer to the "Mitigation" section of CVE-2018-16509 :...

ALPINE-CVE-2018-18073

Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object...

DEBIAN-CVE-2018-18073

Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object...

CVE-2018-18073

Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object...

CVE-2018-18073

CVE-2018-18073 describes a sandbox-bypass vulnerability in Artifex Ghostscript. The issue arises in Ghostscript 9.25 and earlier where the saved execution stack can leak operator arrays or expose system operators in an error object, allowing a crafted PostScript to bypass -dSAFER/sandbox protecti...

CVE-2018-18073

Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object...

CVE-2018-18073: Exposure of Sensitive Information to an Unauthorized Actor

Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object...

UBUNTU-CVE-2018-18073

Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object...

(0Day) Microsoft Windows JScript Error Object Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling o...

Cross Site URL Hijacking by using Error Object in Mozilla Firefox

I want to represent a method for performing Cross Site URL Hijacking which we can call XSUH by using the error object of Mozilla Firefox. XSUH attack is used to steal another website URL. This URL can show the client’s situation on that website, and it can contain confidential parameters such as...