1464 matches found
OESA-2023-1443 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called stat followed by fopen in a way that made it...
Cross-site Scripting (XSS)
gitlab is vulnerable to Cross-site Scripting XSS. The vulnerability occurs due to an improper filtering of query parameters in the wiki changes page allowing a malicious authenticated attacker to execute arbitrary javascript on self-hosted instances running without strict CSP...
Cross-site Scripting (XSS)
gitlab is vulnerable to Cross-site Scripting XSS. A specially crafted payload may allow a malicious attacker to execute arbitrary actions on self-hosted instances running without strict CSP...
AMI MegaRAC SP-X BMC Redfish Vulnerabilities - Lenovo Support US
No description provided...
Design/Logic Flaw
mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on ...
CVE-2023-34458 mx-chain-go's relayed transactions always increment nonce
mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on ...
curl: HSTS amnesia with --parallel
A flaw was found in the Curl package, where the HSTS mechanism could fail when multiple transfers are done in parallel, as the HSTS cache file gets overwritten by the most recently completed transfer. This issue may result in limited confidentiality and integrity...
curl: HSTS bypass via IDN
A vulnerability was found in curl. The issue can occur when curl's HSTS check is bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of an insecure clear-text HTTP step even when providing HTTP in the URL. Suppose the hostname in the given...
curl: HSTS ignored on multiple requests
A flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the same command line because the state would not be properly carried. This issue may result in limited confidentiality and integrity...
curl: HSTS amnesia with --parallel
A flaw was found in the Curl package, where the HSTS mechanism could fail when multiple transfers are done in parallel, as the HSTS cache file gets overwritten by the most recently completed transfer. This issue may result in limited confidentiality and integrity...
curl: HSTS ignored on multiple requests
A flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the same command line because the state would not be properly carried. This issue may result in limited confidentiality and integrity...
Insecure Handling Of Strict-Transport-Security Header
qt6-qtbase is vulnerable to Insecure Handling of Strict-Transport-Security Header. The vulnerability occurs because Qt Network incorrectly parses the Strict-Transport-Security HSTS header, which can result in unencrypted connections being established even when the server explicitly prohibits them...
An issue was discovered in Qt before 5.15.14 6.x before 6.2.9 and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header allowing unencrypted connections to be established even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.
...
CVE-2023-32762
An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security HSTS header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the cas...
OpenShift: Missing HTTP Strict Transport Security
Openshift 4.9 does not use HTTP Strict Transport Security HSTS which may allow man-in-the-middle MITM attacks...
PT-2023-3581 · Qt Company +4 · Qt +4
Name of the Vulnerable Software and Affected Versions: Qt versions prior to 5.15.14 Qt versions 6.x prior to 6.2.9 Qt versions 6.3.x through 6.5.x prior to 6.5.1 Description: An issue in Qt Network incorrectly parses the strict-transport-security HSTS header, allowing unencrypted connections to b...
[SECURITY] Fedora 38 Update: php-nyholm-psr7-1.7.0-1.fc38
A super lightweight PSR-7 implementation. Very strict and very fast.. Autoloader: /usr/share/php/Nyholm/Psr7/autoload.php...
[SECURITY] Fedora 37 Update: php-nyholm-psr7-1.6.1-1.fc37
A super lightweight PSR-7 implementation. Very strict and very fast.. Autoloader: /usr/share/php/Nyholm/Psr7/autoload.php...
The vulnerability of the HSTS (HTTP Strict Transport Security) mechanism in the cURL command line utility allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the HSTS HTTP Strict Transport Security mechanism in the CURL command line utility is related to the transmission of critical information in plaintext when IDN symbols in host names are replaced with similar ASCII symbols. Exploiting this vulnerability can allow an unauthoriz...
The vulnerability of the HSTS (HTTP Strict Transport Security) mechanism in the cURL command line utility allows a attacker to alter the HSTS functionality by making successive requests to multiple URL addresses.
The vulnerability of the HSTS HTTP Strict Transport Security mechanism in the cURL command line utility is related to a problem where multiple requests may lead to HSTS support being ignored. Exploiting this vulnerability could allow a remote attacker to alter HSTS functionality when multiple URL...