88 matches found
curl security and bug fix update
7.29.0-57.0.1 - Fix TFTP small blocksize heap buffer overflow https://curl.haxx.se/docs/CVE-2019-5482.htmlCVE-2019-5482Orabug: 30568724 - Security Fixes OraBug: 28939992 - CVE-2016-8615 cookie injection for other servers https://curl.haxx.se/docs/CVE-2016-8615.html - CVE-2016-8616 case insensitiv...
rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can...
The vulnerability of Modicon microprogrammed controllers lies in the lack of checks for the integrity of updates to the embedded software. This allows a malicious actor to download the updated embedded software with an invalid web server URL via FTP, thereby causing a service failure.
The vulnerability of Modicon microprogrammed controllers lies in the lack of checks for the integrity of updates to the embedded software. Exploiting this vulnerability allows a malicious actor to download updates to the embedded software via an FTP server without an active web server, thereby...
ZEIT: [Fix Bypass #541631] Open redirect on Signup
Some signup and login paths did not verify the ?next= query param properly and allowed an open redirect with a carefully crafted invalid URL. It is standard practise to use a redirect query param in login and signup endpoints but the value should be carefully validated before accepting to redirec...
CVE-2018-19106
Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959...
CVE-2018-19106
Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959...
CVE-2018-19106: URL Redirection to Untrusted Site
Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959...
CVE-2018-1000077
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can...
App Layering 4.1 - Failed to Create Layer, 'A specified parameter was not correct. url'
When attempting to create a layer, the error below is displayed: Failed to execute the script: vCenter returned an unexpected failure = Fault Code: 'ServerFaultCode' FaultMessage: 'A specified parameter was not correct. url' Details: "attributes":"xsi:type":"InvalidArgument","invalidProperty":"u...
CVE-2016-5222
Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...
Hardcoded credentials
Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...
OWOX, Inc.: invalid URL parsing with and '@'
Description : invalid URL parsing with and '@' this can harm full for user Live POC : https://[email protected]...
Amazon Linux AMI : curl (ALAS-2016-766)
This build resolves the following issues : CVE-2016-8615 : Cookie injection for other servers CVE-2016-8616 : Case insensitive password comparison CVE-2016-8617 : Out-of-bounds write via unchecked multiplication CVE-2016-8618 : Double-free in curlmaprintf CVE-2016-8619 : Double-free in krb5 code...
CURL-CVE-2016-8624 invalid URL parsing with '#'
curl does not parse the authority component of the URL correctly when the host name part ends with a hash character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use a URL parser that follows the RFC to check for allowed...
cURL -- multiple vulnerabilities
The cURL project reports cookie injection for other servers case insensitive password comparison OOB write via unchecked multiplication double-free in curlmaprintf double-free in krb5 code glob parser write/read out of bounds curlgetdate read out of bounds URL unescape heap overflow via integer...
Paragon Initiative Enterprises: Information Disclosure in Error Page
Hello, Here's an crafted URL which discloses web server used and version of same. https://paragonie.com/%PI Even-though most error pages are handled by generic pages in paragonie.com, above given 400 Bad Request sample is not handled. It seems this error page is because of Invalid URL Encoded %PI...
Apple Quicktime Invalid URL Atom Size Denial of Service Vulnerability
Talos Vulnerability Report TALOS-2015-0012 Apple Quicktime Invalid URL Atom Size Denial of Service Vulnerability August 13, 2015 CVE Number CVE-2015-3788 Description An exploitable denial of service vulnerability exists in Apple Quicktime. An attacker who can control the size of a “url” atom in a...
CVE-2014-1349
Use-after-free vulnerability in Safari in Apple iOS before 7.1.2 allows remote attackers to execute arbitrary code or cause a denial of service application crash via an invalid URL...
CVE-2014-1349
CVE-2014-1349 affects Safari on Apple iOS before 7.1.2. The vulnerability is a use-after-free in Safari’s handling of invalid URLs, allowing remote attackers to cause an app crash or potentially execute arbitrary code. The Apple advisory (iOS 7.1.2) documents a set of fixes; for this CVE, upgrade...