910 matches found
CVE-2019-17596: Interpretation Conflict
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates...
DEBIAN-CVE-2019-17669
WordPress before 5.2.4 has a Server Side Request Forgery SSRF vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters...
Server side request forgery (ssrf)
WordPress before 5.2.4 has a Server Side Request Forgery SSRF vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters...
The vulnerability of Thunderbird email client, as well as browsers Firefox and Firefox ESR, is related to improper syntactic analysis of page content or interpretation of data entered by users. This vulnerability allows attackers to execute arbitrary code.
The vulnerability of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, is related to incorrect syntax analysis of page content or improper interpretation of data entered by users. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
CVE-2017-2666
It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP...
The vulnerability of the printcontrol-web utility in the Astra Linux operating system, which allows a intruder to trigger a service failure.
The vulnerability of the printcontrol-web utility in the Astra Linux operating system is related to data interpretation errors during card filling. Exploiting this vulnerability can allow a perpetrator to cause service failures...
CVE-2019-16276
It was discovered that net/http through net/textproto in golang does not correctly interpret HTTP requests where an HTTP header contains spaces before the colon. This could be abused by an attacker to smuggle HTTP requests when a proxy or a firewall is placed behind a server implemented in Go or ...
CVE-2019-10401
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents typically Job/Configure...
Cross site scripting
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents...
Cross site scripting
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents typically Job/Configure...
CVE-2019-10401
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents typically Job/Configure...
CVE-2019-10402
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents...
XSS vulnerability in combobox form control
Jenkins interpreted items added to f:combobox form controls as HTML. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the contents of f:combobox form controls. Jenkins no longer interprets items added to a combobox as HTML. NOTE ====== This might be a...
Stored XSS vulnerability in expandable textbox form control
Jenkins form controls include an expandable textbox that can transform from a single-line text box to a multi-line text area. The implementation of this transformation interpreted the text content of the form field as HTML. This resulted in a cross-site scripting vulnerability exploitable by...
CVE-2019-10402: Improper Neutralization of Input During Web Page Generation
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents...
PT-2019-20320
Уязвимость утилиты printcontrol-web операционной системы Astra Linux связана с ошибками интерпретации данных при заполнении карточки. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...
CVE-2019-10192
A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write ...
X (Formerly Twitter): Wrong Interpretation of URL encoded characters, showing different punny code leads to redirection on different domain
Summary: There is wrong interpretation of URL encoded characters at https://twitter.com/safety/unsafelinkwarning endpoint which could lead to different location then what is supposed to. Although it shows warning but doesn't show warning about punny code characters. Description: On following...
Cross site scripting
A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be use...
Denial Of Service (DOS)
The GNU Privacy Guard GnuPG or GPG is a tool for encrypting data and creating digital signatures, compliant with the proposed OpenPGP Internet standard and the S/MIME standard. It was found that GnuPG was vulnerable to the Yarom/Falkner flush+reload cache side-channel attack on the RSA secret...