10747 matches found
dotnet: infinite loop in Uri.TryCreate leading to ASP.Net Core Denial of Service
A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981...
CVE-2019-12173
MacDown 0.7.1 870 allows remote code execution via a file:\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138...
CVE-2019-12173
MacDown 0.7.1 870 allows remote code execution via a file:\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138...
Remote code execution
MacDown 0.7.1 870 allows remote code execution via a file:\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138...
CVE-2019-12173
MacDown 0.7.1 is affected by CVE-2019-12173. The Red Hat advisory and OSV records describe a remote code execution path triggered by a file:\ URI with a ".app" pathname in the HREF of an A element, enabling arbitrary code execution if a crafted note is opened. Affected component is the MacDown vi...
CVE-2019-12173
MacDown 0.7.1 870 allows remote code execution via a file:\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138...
dotnet: infinite loop in Uri.TryCreate leading to ASP.Net Core Denial of Service
A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981...
Updated python packages fix security vulnerability
Updated python packages fix security vulnerability: A 'file:' blacklist bypass in URIs by using the 'local-file:' scheme instead CVE-2019-9948...
Arbitrary Code Execution
Firefox, Firefox ESR and Thunderbird are vulnerable to arbitrary code execution attacks. A remote unauthenticated attacker could exploit the vulnerable URI Handler component by spoofing the origin of a modal alert via iframe content and the 'data:' protocol leading to potential code execution...
Remote Code Execution (RCE)
firefox/thunderbird is vulnerable to remote code execution. A use-after-free vulnerability in the HTMLVideoElement interface allows remote attackers to execute arbitrary code via Javascript code that modifies the URI table of a media element...
Cross-site Scripting (XSS)
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...
Fedora 30 : webkit2gtk3 (2019-d9a15be3ba)
Do not allow changes in active URI before provisional load starts for non-API requests. - Stop the threaded compositor when the page is not visible or layer tree state is frozen. - Use WebKit HTTP source element again for adaptive streaming fragments downloading. - Properly handle empty resources...
CVE-2019-11626
routers/ajaxRouter.php in doorGets 7.0 has a web site physical path leakage vulnerability, as demonstrated by an ajax/index.php?uri=1234%5c request...
Cross site request forgery (csrf)
An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1. CSRF can occur via a /CollatWebApp/gcmsRefInsert?name=SUPP URI...
Atlassian SourceTree 1.2 < 3.1.1 Multiple remote code execution vulnerabilities
The version of Atlassian SourceTree installed on the remote Windows host is version 1.2 prior to 3.1.1. It is, therefore, affected by multiple remote code execution vulnerabilities. - An option injection vulnerability exists in the git submodule component. An unauthenticated, remote attacker can...
Code injection
esoTalk 1.0.0g4 has XSS via the PATHINFO to the conversations/ URI...
CVE-2015-9285
esoTalk 1.0.0g4 has XSS via the PATHINFO to the conversations/ URI...
CVE-2015-9285
CVE-2015-9285 affects esoTalk 1.0.0g4. The vulnerability is a reflected XSS via PATH_INFO to the conversations/ URI. NVD CVSS data: CVSS v2 base score 4.3 (MEDIUM) with network attack vector and no confidentiality impact but partial integrity impact; CVSS v3 base score 6.1 (MEDIUM) with network a...