CVE-2020-14327: Server-Side Request Forgery (SSRF)

A Server-side request forgery SSRF flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of...

PT-2021-10093

Name of the Vulnerable Software and Affected Versions: Apache Fineract versions prior to 1.5.0 Description: The issue allows for a man-in-the-middle attack due to the disabling of HTTPS hostname verification in the configureClient method of ProcessorHelper. This could be successful under typical...

CVE-2021-28662

CVE-2021-28662 affects Squid 4.x before 4.15 and 5.x before 5.0.6. A remote server sending a certain HTTP/HTTPS response header can trigger a denial-of-service in the proxy via input/response handling. This is the same class of DoS as described in multiple advisories (e.g., Arch Linux, Debian, Al...

CVE-2021-28662

An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic...

Apache Fineract security vulnerabilities

Apache Fineract is a set of open source digital financial services platform from the U.S. Apache Apache Foundation. The platform can provide users with data management, loan and savings portfolio management and real-time financial data and other functions. A security vulnerability exists in Apach...

PT-2021-19827

Name of the Vulnerable Software and Affected Versions Tenancy multi-tenant versions prior to 5.7.2 Description The issue allows for open redirects, where users can be redirected from the site to any other site using a specially crafted URL. This occurs in installations using the default Hostname...

CVE-2021-28662

An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic...

CVE-2021-28662: Improper Encoding or Escaping of Output

An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic...

EUVD-2021-15326

An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic...

CVE-2021-28662

An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic...

CVE-2021-28662

An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic...

Design/Logic Flaw

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM and MCSESP V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker...

CVE-2021-22731

CVE-2021-22731 affects Schneider Electric Modicon Managed Switch MCSESM* and MCSESP* up to version 8.21. Description: Weak Password Recovery Mechanism for Forgotten Password enables an unauthorized password change via HTTP/HTTPS when basic user information is known by a remote attacker. Impact: p...

CVE-2021-22731: Weak Password Recovery Mechanism for Forgotten Password

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM and MCSESP V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker...

PT-2021-15181

Name of the Vulnerable Software and Affected Versions Modicon Managed Switch MCSESM and MCSESP versions V8.21 and prior Description A Weak Password Recovery Mechanism for Forgotten Password issue exists, allowing an unauthorized password change through HTTP / HTTPS when basic user information is...

ABPTTS - TCP Tunneling Over HTTP/HTTPS For Web Application Servers

A Black Path Toward The Sun TCP tunneling over HTTP for web application servers https://www.blackhat.com/us-16/arsenal.htmla-black-path-toward-the-sun Ben Lincoln, NCC Group, 2016 ABPTTS uses a Python client script and a web application server page/package1 to tunnel TCP traffic over an HTTP/HTTP...

Ubiquiti Networks EdgeOS Improper Certificate Validation Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ubiquiti Networks EdgeOS on EdgeRouter X, EdgeRouter Pro X SFP, EdgeRouter 10X and EdgePoint 6-port routers. User interaction is required to exploit this vulnerability in that an administrator must...

Improper Certificate Validation in WP-CLI framework

Impact An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability...

GHSA-RWGM-F83R-V3QJ Improper Certificate Validation in WP-CLI framework

Impact An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability...

Improper Certificate Validation in WP-CLI framework

Description Impact An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including...