CVE-2019-18187

creationtimestamp| type| source ---|---|--- 2020-01-27 14:04:36+00:00| exploited| https://t.me/truesecator/81 2020-03-18 10:11:36+00:00| exploited| https://t.me/truesecator/334 2020-03-18 10:35:38+00:00| exploited| https://t.me/avdno/704 2021-11-08 08:58:20+00:00| seen|...

CVE-2007-6758

Server-side request forgery SSRF vulnerability in feed-proxy.php in extjs 5.0.0...

CVE-2007-6758

Server-side request forgery SSRF vulnerability in feed-proxy.php in extjs 5.0.0...

CVE-2007-6758

CVE-2007-6758 describes a Server-Side Request Forgery (SSRF) in feed-proxy.php of ExtJS 5.0.0. Affected component/file: feed-proxy.php; root cause not detailed in available documents beyond SSRF. Impact semantics: CVSS v2 base score 5.0 (MEDIUM) and CVSS v3.1 base score 7.5 (HIGH) with Network ac...

CVE-2020-2551

creationtimestamp| type| source ---|---|--- 2020-01-21 19:54:53+00:00| seen| https://t.me/HackerOne/2598 2021-03-27 21:09:01+00:00| seen| https://t.me/reconshell/599 2021-09-05 16:58:17+00:00| published-proof-of-concept| https://t.me/infosec1z/47 2023-01-06 07:19:03+00:00|...

CVE-2019-20085

creationtimestamp| type| source ---|---|--- 2020-01-21 14:52:47+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tvtnvmstraversal.rb 2021-11-08 08:58:20+00:00| seen| MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422 2021-11-20 09:53:52+00:00| seen|...

CVE-2012-4451

Multiple cross-site scripting XSS vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to 1 Debug, 2 Feed\PubSubHubbub, 3 Log\Formatter\Xml, 4 Tag\Cloud\Decorator, 5 Uri, 6 View\Helper\HeadStyle, 7...

UBUNTU-CVE-2012-4451

Multiple cross-site scripting XSS vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to 1 Debug, 2 Feed\PubSubHubbub, 3 Log\Formatter\Xml, 4 Tag\Cloud\Decorator, 5 Uri, 6 View\Helper\HeadStyle, 7...

Reminder: CISA Publishes Weekly Vulnerability Summaries

Did you know that the Cybersecurity and Infrastructure Security Agency CISA publishes a weekly Vulnerability Bulletin? This recurring item provides a summary of all new vulnerabilities that have been recorded by the CISA-sponsored National Institute of Standards and Technology NIST National...

mybb -- multible vulnerabilities

mybb Team reports: High risk: Installer RCE on settings file write Medium risk: Arbitrary upload paths and Local File Inclusion RCE Medium risk: XSS via insufficient HTML sanitization of Blog feed and Extend data Low risk: Open redirect on login Low risk: SCEditor reflected XSS...

CVE-2019-6031

Cross-site scripting vulnerability in KINZA for Windows version 5.9.2 and earlier and for Mac version 5.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via RSS reader...

PYSEC-2019-136

Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end serve...

CVE-2019-1458

creationtimestamp| type| source ---|---|--- 2019-12-10 19:52:29+00:00| exploited| https://t.me/ctinow/18489 2019-12-10 21:20:08+00:00| exploited| https://t.me/ctinow/18498 2019-12-11 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=439 2019-12-11 07:30:18+00:00| seen|...

The vulnerability of the Google Chrome browser arises from its inability to handle sequences of characters CRLF, which allows attackers to circumvent navigation restrictions.

The vulnerability of the Google Chrome browser exists due to the failure to address the issue of eliminating CRLF sequences. Exploiting this vulnerability allows a remote attacker to circumvent navigation restrictions by using a specially created HTML page...

Armeria Injection Vulnerability

Armeria is an open source library for building asynchronous microservers that use HTTP/2 as the session layer protocol. Armeria suffers from an injection vulnerability. The vulnerability stems from a lack of proper validation of user input data by a network system or product during the course of ...

DEBIAN-CVE-2019-19330

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return CR, ASCII 0xd, line feed LF, ASCII 0xa, and the zero character NUL, ASCII 0x0, aka Intermediary Encapsulation Attacks...

UBUNTU-CVE-2019-19330

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return CR, ASCII 0xd, line feed LF, ASCII 0xa, and the zero character NUL, ASCII 0x0, aka Intermediary Encapsulation Attacks...

The vulnerability of the WEBrick library for the Ruby programming language allows attackers to inject arbitrary HTTP headers.

The vulnerability of the WEBrick library for the Ruby programming language interpreter is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTTP headers remotely...

DEBIAN-CVE-2010-3438

libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the client to disconnect from the server...

Open Redirect Bug in Bridge Theme Plugin Opens Admins to Spearphishing

Two open-redirect vulnerabilities in Bridge, a commercial WordPress theme purchased more than 120,000 times, would allow an attacker to mount spearphishing attacks against site administrators. An open redirect vulnerability can be used to hide malicious links behind URLs for legitimate domains. F...