CVE-2019-5489

The mincore implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. Fixing this affects the output of the fincore program. Limited...

CVE-2019-5489

The mincore implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. Fixing this affects the output of the fincore program. Limited...

Fedora 28 : httpd (2018-6744ca470d)

This update includes the latest upstream release of the Apache HTTP Server, version 2.4.33. A number of security vulnerabilities are fixed in this release : - Low: Possible out of bound read in modcachesocache CVE-2018-1303 - Low: Possible out of bound access after failure in reading the HTTP...

EulerOS 2.0 SP2 : curl (EulerOS-SA-2018-1427)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that curl and libcurl might send their Authentication header to a third party HTTP server upon receiving an HTTP REDIRECT reply. This...

Design/Logic Flaw

SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend...

CVE-2018-20370

SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend...

CVE-2018-20370

SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend...

CVE-2018-20370

SZ NetChat before 7.9 is vulnerable to Cross-Site Scripting in the Options module (MyName input). The root cause is an XSS flaw in the MyName field, allowing a remote attacker to inject inputs that could compromise the enabled HTTP server web frontend. The public references consistently describe ...

[SECURITY] Fedora 28 Update: php-7.2.13-2.fc28

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

NetChat v7.8 - Persistent Cross Site Scripting Vulnerability

Document Title: =============== NetChat v7.8 - Persistent Cross Site Scripting Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2174 Watch Video: https://www.youtube.com/watch?v=2u-DHd5zlQw Advisory: https://www.vulnerability-lab.com/getcontent.php?id=2171...

NetChat v7.8 - Persistent Cross Site Scripting Vulnerability

Document Title: =============== NetChat v7.8 - Persistent Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2171 Video: https://www.vulnerability-lab.com/getcontent.php?id=2174...

Amazon Linux AMI : httpd24 (ALAS-2018-1104)

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol...

NetChat v7.8 - Persistent Cross Site Scripting Vulnerability

Document Title: =============== NetChat v7.8 - Persistent Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2171 Video: https://www.vulnerability-lab.com/getcontent.php?id=2174...

imaginaryC2 - Tool Which Aims To Help In The Behavioral (Network) Analysis Of Malware

author: Felix Weyne website Twitter Imaginary C2 is a python tool which aims to help in the behavioral network analysis of malware. Imaginary C2 hosts a HTTP server which captures HTTP requests towards selectively chosen domains/IPs. Additionally, the tool aims to make it easy to replay captured...

CVE-2018-20149

In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data...

CVE-2018-20149

In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data...

CVE-2018-20149

WordPress vulnerability CVE-2018-20149 affects WordPress versions prior to 4.9.9 and 5.x prior to 5.0.1 when using Apache. The issue allows uploading crafted files that bypass MIME-type restrictions, enabling cross-site scripting (XSS) as demonstrated by a .jpg file without JPEG data. Debian/DSA ...

Medium: httpd24

Issue Overview: In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2...

EulerOS 2.0 SP3 : curl (EulerOS-SA-2018-1401)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that curl and libcurl might send their Authentication header to a third party HTTP server upon receiving an HTTP REDIRECT reply. This...

Evilginx2 v2.2.0 - Standalone Man-In-The-Middle Attack Framework Used For Phishing Login Credentials Along With Session Cookies, Allowing For The Bypass Of 2-Factor Authentication

evilginx2 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection. This tool is a successor to Evilginx, released in 2017, which used a custom version of nginx HTTP server to provide...