4690 matches found
PT-2017-13295
Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to the oauth function in the controllers/member/api.php file, which has an XSS vulnerability concerning the Referer HTTP header, specifically with Internet Explorer. Recommendations For...
PT-2017-13296
Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to an XSS vulnerability in the out function in controllers/member/Login.php. This vulnerability is triggered by the Referer HTTP header and affects Internet Explorer. Recommendations For...
CVE-2017-14194: Improper Neutralization of Input During Web Page Generation
The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer...
CVE-2017-14195: Improper Neutralization of Input During Web Page Generation
The callmsg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explorer...
CVE-2017-14193: Improper Neutralization of Input During Web Page Generation
The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer...
PT-2017-13297
Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to the call msg function in the controllers/Form.php file, potentially allowing XSS attacks related to the Referer HTTP header, specifically with Internet Explorer. Recommendations For...
MGASA-2017-0325 Updated rt/perl-Encode packages fix security vulnerability
RT 4.0.0 and above are vulnerable to a limited privilege escalation leading to unauthorized modification of ticket data. The DeleteTicket right and any custom lifecycle transition rights may be bypassed by any user with ModifyTicket CVE-2012-4733. RT 3.8.0 and above include a version of bin/rt th...
CVE-2017-14037
CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability...
Design/Logic Flaw
CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability...
CVE-2017-14037
CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability...
CVE-2017-14037
CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability...
CVE-2017-14037
CVE-2017-14037 affects CrushFTP before 7.8.0 and 8.x before 8.2.0, described as an HTTP header vulnerability. Public documents confirm the affected versions and nature of the issue across NVD/Red Hat/CNVD entries; exploitation details are not provided in the supplied materials. CVSS data present ...
CVE-2017-14037: Improper Neutralization of CRLF Sequences
CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability...
PT-2017-13217
Name of the Vulnerable Software and Affected Versions CrushFTP versions prior to 7.8.0 CrushFTP versions 8.x prior to 8.2.0 Description The issue is related to an HTTP header vulnerability. Recommendations For CrushFTP versions prior to 7.8.0, update to version 7.8.0 or later. For CrushFTP versio...
WordPress: Clickjacking mercantile.wordpress.org
A Clickjaking Issue had been previously reported by "giantfire" on Aug 9th 19 days ago and the issue was fixed by "iandunn" on Aug 25th 3 days ago and the same disclosed on Aug 28th. Here the affected URL is- https://mercantile.wordpress.org/ "iandunn closed the report and changed the status to...
Heap overflow
HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30...
CVE-2015-1445
HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30...
CVE-2015-1445
CVE-2015-1445 affects the fli4l httpd component. The connected documents confirm an HTTP header injection vulnerability in the httpd package for fli4l before 3.10.1 and in version 4.0 before 2015-01-30. The CVSS metrics indicate a NETWORK-exposed issue with HIGH severity (CVSS v3.0: AV:N/AC:L/PR:...
HTTP Header Injection
vertx-core is vulnerable to HTTP header injections. The library does not validate HTTP header values, allowing attackers to inject arbitrary headers in requests. This vulnerability is a different vulnerability from CVE-2018-12537, however the fix for CVE-2018-12537 remediates this vulnerability...