22 matches found
GHSA-3Q6G-QMPX-RQW4 Whoogle Search Server-Side Request Forgery vulnerability
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the window endpoint does not sanitize user-supplied input from the location variable and passes it to the send method which sends a GET request on lines 339-343 in request.py, which leads to a server-side request...
CVE-2024-22205
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the window endpoint does not sanitize user-supplied input from the location variable and passes it to the send method which sends a GET request on lines 339-343 in request.py, which leads to a server-side request...
CVE-2024-22205
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the "window" endpoint does not sanitize user-supplied input from the "location" variable and passes it to the "send" method which sends a "GET" request on lines 339-343 in "request.py," which leads to a server-side...
CVE-2024-22205: Server-Side Request Forgery (SSRF)
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the window endpoint does not sanitize user-supplied input from the location variable and passes it to the send method which sends a GET request on lines 339-343 in request.py, which leads to a server-side request...
PT-2017-17543
Name of the Vulnerable Software and Affected Versions iOS versions prior to 11 Description An issue in certain Apple products involves the Location Framework component, allowing attackers to obtain sensitive location information via a crafted app that reads the location variable. Recommendations...
UBUNTU-CVE-2016-4758
WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site...
CVE-2016-4758
WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site...
PT-2016-6116
Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 10 iTunes versions prior to 12.5.1 on Windows Safari versions prior to 10 Description The issue allows remote attackers to obtain sensitive information via a crafted web site due to improper restriction of access to...
KLA10877 Multiple vulnerabilities in iTunes
Multiple serious vulnerabilities have been found in Apple iTunes. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, bypass security restrictions or obtain sensitive information. Below is a complete list of vulnerabilities 1. Multiple unknown...
webkit2gtk: multiple issues
CVE-2016-4590 same-origin policy bypass xisigr of Tencents Xuanwu Lab discovered a vulnerability in the way webkit handles URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. - CVE-2016-4591 arbitrary filesystem access ma.la of LINE Corporation discoveered...
CVE-2016-4591
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors...
Design/Logic Flaw
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors...
CVE-2016-4591
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors...
CVE-2016-4591
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors...
CVE-2016-4591
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors...
UBUNTU-CVE-2016-4591
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors...
PT-2016-6048
Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 9.3.3 Safari versions prior to 9.1.2 tvOS versions prior to 9.2.2 Description The issue concerns the mishandling of the location variable, allowing remote attackers to access the local filesystem. Recommendations Fo...
CVE-2012-0846
Cross-site scripting XSS vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the Location variable...
Cross site scripting
Cross-site scripting XSS vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the Location variable...
PT-2012-2902
Name of the Vulnerable Software and Affected Versions WebCalendar version 1.2.4 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the Location variable. This can lead to the execution of malicious scripts on the client-side. Recommendation...