484 matches found
USN-5034-2 c-ares vulnerability
USN-5034-1 fixed a vulnerability in c-ares. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Philipp Jeitner and Haya Shulman discovered that c-ares incorrectly validated certain hostnames returned by DNS servers. A remote attacker could possibly use...
USN-5034-1 c-ares vulnerability
Philipp Jeitner and Haya Shulman discovered that c-ares incorrectly validated certain hostnames returned by DNS servers. A remote attacker could possibly use this issue to perform Domain Hijacking attacks...
UBUNTU-CVE-2021-3672
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as we...
libcares2 跨站脚本漏洞
libcares2 is a C library in the openSUSE project that performs DNS requests and name resolution asynchronously. A cross-site scripting vulnerability exists in libcares2 that stems from improper validation of hostname input...
Fossil 信任管理问题漏洞
Fossil is a simple, highly reliable distributed software configuration management system. A security vulnerability exists in Fossil that stems from a hostname check that is commonly skipped during certificate validation. This issue affects: versions prior to 2.15, versions prior to 2.14. No detai...
GHSA-MJXR-4V3X-Q3M4 Improper Input Validation in sanitize-html
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts...
Improper Certificate Validation in TweetStream
TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack...
Improper Certificate Validation in TweetStream
TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack...
Improper Certificate Validation in twitter-stream
In voloko twitter-stream 0.1.16, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...
CVE-2021-3275
Unauthenticated stored cross-site scripting XSS exists in multiple TP-Link products including WIFI Routers Wireless AC routers, Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper...
CVE-2021-3275
Unauthenticated stored cross-site scripting XSS exists in multiple TP-Link products including WIFI Routers Wireless AC routers, Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper...
TP-Link Cross Site Scripting
============================================================== Unauthenticated Stored Cross-site Scripting in Multiple TP-Link Devices ============================================================== Overview ======== Title:- Unauthenticated Stored Cross-site Scripting in TP-Link Devices. CVE-ID :-...
RHEL 7 : rubygem-em-http-request (RHSA-2021:0937)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:0937 advisory. EventMachine based, async HTTP Request client. Security Fixes: missing SSL hostname validation allows MITM CVE-2020-13482 For more details about the...
CVE-2021-28363
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates for...
PT-2021-17850
Name of the Vulnerable Software and Affected Versions: urllib3 versions 1.26.x through 1.26.3 Description: The issue concerns the omission of SSL certificate validation in certain cases involving HTTPS to HTTPS proxies. Specifically, when an SSLContext is not provided via proxy config, the initia...
CVE-2020-11050
In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hostname validation. This has been patched in 1.5.0...
CVE-2021-26539
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name IDN which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option...
Man-in-the-Middle (MitM)
Overview Affected versions of this package are vulnerable to Man-in-the-Middle MitM due to Missing TLS hostname validation. Remediation There is no fixed version for twitter-stream. References - GitHub Security Advisory - GitHub Security Advisory Credit: Agustin Gianni...
Man-in-the-Middle (MitM)
Overview Affected versions of this package are vulnerable to Man-in-the-Middle MitM due to Missing TLS hostname validation. Remediation There is no fixed version for tweetstream. References - GitHub Security Advisory - GitHub Security Advisory Credit: Agustin Gianni...