4144 matches found
Schiphol hijack false alarm. An insiders view of what happened
I had the misfortune of being at Schiphol last night as this unfolded: All ended well, delayed by about an hour. Had the incident been real, it could have been much worse. Here’s what the pilot had to say about it thanks to @asantosb: Our flight was at D16, the incident flight was directly the...
Ansible: disclosure data when prompted for password and template characters are passed
A data disclosure flaw was found in ansible. Password prompts in ansible-playbook and ansible-cli tools could expose passwords with special characters as they are not properly wrapped. A password with special characters is exposed starting with the first of these special characters. The highest...
CVE-2019-16680
A path traversal vulnerability was discovered in the file-roller Archive Manager for GNOME in the way file paths with special characters are sanitized. Archives containing the sequence of characters "../" in a file path may be vulnerable to this flaw. A remote attacker could exploit this flaw by...
The vulnerability of the ZingBox Inspector, a network traffic handler, arises due to the failure to take measures to neutralize special elements. This vulnerability allows a violator to unauthorizedly intercept and modify software update packets.
The vulnerability of the ZingBox Inspector network traffic handler exists because special elements are not properly neutralized. Exploiting this vulnerability allows a malicious actor to intercept and modify software update packets remotely and without authorization...
GitLab: Stored XSS in merge request pages
A stored cross-site scripting XSS vulnerability was discovered in GitLab merge request pages. An attacker could exploit this vulnerability by creating a merge request with a specially crafted branch name and tricking a user with insufficient permissions to view the merge request page. This could...
ham3d 1.1 Information Disclosure / Default Credentials
/ Exploit Title: ham3d Information Processing Script Local File Download & Default Password Vulnerability Exploit Author: Milad Hacking Vendor Homepage : http://www.ham3d.net/ Demo Script Link: http://wensoni.com Version : 1.1 Google Dork : inurl:fa/forgotpass.html Date: 2019-10-25 Tested on: Kal...
ansible: Incomplete fix for CVE-2019-10206
The fix for CVE-2019-10206 was found to be incomplete for the data disclosure flaw in ansible. Password prompts in ansible-playbook and ansible-cli tools could expose passwords with special characters as they are not properly wrapped. A password with special characters is exposed starting with th...
ansible: Incomplete fix for CVE-2019-10206
The fix for CVE-2019-10206 was found to be incomplete for the data disclosure flaw in ansible. Password prompts in ansible-playbook and ansible-cli tools could expose passwords with special characters as they are not properly wrapped. A password with special characters is exposed starting with th...
ansible: Incomplete fix for CVE-2019-10206
The fix for CVE-2019-10206 was found to be incomplete for the data disclosure flaw in ansible. Password prompts in ansible-playbook and ansible-cli tools could expose passwords with special characters as they are not properly wrapped. A password with special characters is exposed starting with th...
ansible: Incomplete fix for CVE-2019-10206
The fix for CVE-2019-10206 was found to be incomplete for the data disclosure flaw in ansible. Password prompts in ansible-playbook and ansible-cli tools could expose passwords with special characters as they are not properly wrapped. A password with special characters is exposed starting with th...
The vulnerability of the ZingBox Inspector, a network traffic handler, arises due to the lack of measures to neutralize special elements. This allows attackers to execute arbitrary code.
The vulnerability of the ZingBox Inspector network traffic processor exists due to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2019-12148
The Sangoma Session Border Controller SBC 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability involving special characters in the username field. Upon successful exploitation, a remote unauthenticated user can login into the device's admin...
CVE-2019-12148
The CVE-2019-12148 issue affects Sangoma SBC 2.3.23-119 GA web interface, where an authentication bypass is triggered by an argument-injection flaw in the username field. Exploitation allows a remote unauthenticated attacker to log into the device’s admin web portal without credentials, affecting...
CyberArk Password Vault 10.6 - Authentication Bypass
Exploit Title: CyberArk Password Vault 10.6 - Authentication Bypass Date: 2019-10-16 Author: Daniel Martinez Adan adon90 Vendor: https://www.cyberark.com Software: https://www.cyberark.com/products/privileged-account-security-solution/enterprise-password-vault/ Collaborator: Luis Buendía...
Cross-Site Scripting (XSS)
bootstrap-3-typeahead is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser due to improper special characters escaping...
Important: Red Hat Security Advisory: Red Hat Quay v3.1.1 security update
Updated Quay packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Cross-site Scripting (XSS)
rack-mini-profiler is vulnerable to cross-site scripting XSS. The vulnerability exists as certain browsers do not encode special characters in the URL, allowing the value of postfix to cause XSS...
The vulnerability of the virtualization manager in Cisco IOS XE, allowing a attacker to execute arbitrary commands in the Linux kernel with root privileges.
The vulnerability of the virtualization manager in Cisco IOS XE operating systems exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands on the Linux base...
Format string
Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to sentregister.php allowing special characters to be included and an XSS payload to be injected...
