6619 matches found
Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch
Description The Authorization header leaks from same hostname https-http redirect. If https://example.com redirects to http://example.com, then an attacker who can listen in on the wire or perform a MITM attack will be able to receive the Authorization header due to the use of the insecure HTTP...
EulerOS Virtualization 3.0.6.6 : sssd (EulerOS-SA-2022-1148)
According to the versions of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire...
UBUNTU-CVE-2022-0561
Null source pointer passed as an argument to memcpy function within TIFFFetchStripThing in tifdirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712...
RUSTSEC-2022-0041 Unsoundness of AtomicCell<*64> arithmetics on 32-bit targets that support Atomic*64
Impact Affected versions of this crate incorrectly assumed that the alignment of i,u64 was always the same as AtomicI,U64. However, the alignment of i,u64 on a 32-bit target can be smaller than AtomicI,U64. This can cause the following problems: - Unaligned memory accesses - Data race Crates usin...
Fetch Softworks Fetch FTP Client 5.8 - Remote CPU Consumption (Denial of Service)
Exploit Title: Fetch Softworks Fetch FTP Client 5.8 - Remote CPU Consumption Denial of Service Exploit Author: liquidworm !/usr/bin/env python Fetch Softworks Fetch FTP Client 5.8 Remote CPU Consumption Denial of Service Vendor: Fetch Softworks Product web page: https://www.fetchsoftworks.com...
PT-2022-9546
Name of the Vulnerable Software and Affected Versions The Asset CleanUp: Page Speed Booster WordPress plugin versions prior to 1.3.8.5 Description The issue arises from the plugin's failure to sanitise and escape posted parameters sent to the "wpassetcleanup fetch active plugins icons" AJAX actio...
Fetch Softworks Fetch FTP Client 5.8 Denial Of Service
!/usr/bin/env python Fetch Softworks Fetch FTP Client 5.8 Remote CPU Consumption Denial of Service Vendor: Fetch Softworks Product web page: https://www.fetchsoftworks.com Affected version: 5.8.2 5K1354 Summary: Fetch is a reliable, full-featured file transfer client for the Apple Macintosh whose...
Fetch Softworks Fetch FTP Client 5.8 Denial Of Service Exploit
Fetch Softworks Fetch FTP Client version 5.8 suffers from a remote CPU consumption denial of service vulnerability. !/usr/bin/env python Fetch Softworks Fetch FTP Client 5.8 Remote CPU Consumption Denial of Service Vendor: Fetch Softworks Product web page: https://www.fetchsoftworks.com Affected...
Fetch Softworks Fetch FTP Client 5.8 Remote CPU Consumption (Denial of Service)
Summary Fetch is a reliable, full-featured file transfer client for the Apple Macintosh whose user interface emphasizes simplicity and ease of use. Fetch supports FTP and SFTP, the most popular file transfer protocols on the Internet for compatibility with thousands of Internet service providers,...
PT-2022-37265
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. The crash state...
GHSA-R683-J2X4-V87G node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site...
10secondsofcode-custom (1.0.0), 123-x-ed-eied (>=1.0.5, <=1.0.6) +10673 more potentially affected by CVE-2022-0235 via node-fetch (>=2.0.0, <=2.6.6)
node-fetch NPM version =2.0.0, =1.0.5, =1.0.0, =1.0.1, =1.0.0-beta.32, =0.24.0, =0.0.8, =0.0.1, =0.0.0-alpha.1, =1.0.43, =0.0.80, =0.1.3-rc9 and more Source cves: CVE-2022-0235 Source advisory: OSV:GHSA-R683-J2X4-V87G...
4i18n-cli (>=0.0.2, <=0.0.7), @2060.io/credo-ts-didcomm-media-sharing (>=0.0.2, <=0.0.3) +1049 more potentially affected by CVE-2022-0235 via node-fetch (>=3.0.0, <=3.1.0)
node-fetch NPM version =3.0.0, =0.0.2, =0.0.2, =0.0.4, =0.0.0-alpha.117, =0.0.0-alpha.117, =0.0.0-alpha.119, =1.2.1-dev.3, =1.2.1-dev.3, =1.2.1-dev.3, =1.0.0, =2.0.0-beta.0, =2.0.0-beta.1 and more Source cves: CVE-2022-0235 Source advisory: OSV:GHSA-R683-J2X4-V87G...
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site...
CVE-2022-22156: Improperly Implemented Security Check for Standard
An Improper Certificate Validation weakness in the Juniper Networks Junos OS allows an attacker to perform Person-in-the-Middle PitM attacks when a system script is fetched from a remote source at a specified HTTPS URL, which may compromise the integrity and confidentiality of the device. The...
Five Star Business Profile and Schema < 2.1.7 - Subscriber+ Page Creation & Settings Update to Stored XSS
The plugin does not have any authorisation and CSRF in its bpfwpwelcomeaddcontactpage and bpfwpwelcomesetcontactinformation AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting...
Information Disclosure
node-fetch is vulnerable to information disclosure. The vulnerability exists due to the cookie header being leaked to third party site which allows an attacker to gain access to sensitive information...
The vulnerability of the fetch module in the Ansible configuration management system stems from deficiencies in path name restrictions, allowing attackers to access confidential data and compromise its integrity.
The vulnerability of the fetch module in the Ansible configuration system is related to deficiencies in pathname restrictions for directories. Exploiting this vulnerability could allow an attacker to access confidential data and compromise its integrity...
