USN-5632-1 python-oauthlib vulnerability

Sebastian Chnelik discovered that OAuthLib incorrectly handled certain redirect uris. A remote attacker could possibly use this issue to cause OAuthLib to crash, resulting in a denial of service...

PYSEC-2022-269

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of urivalidate functions depending where it is used. OAuthLib...

Cross-site Scripting (XSS)

org.apache.jspwiki:jspwiki is vulnerable to cross-site scripting. The vulnerability exists in execute function in Denounce.java because the Denounce's link parameter URIs are not properly validated which allows an attacker to inject and execute a specifically crafted link parameter to gain access...

CVE-2021-42537

VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output...

Code injection

VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output...

PT-2022-11609 · Unknown · Visam Vbase

Name of the Vulnerable Software and Affected Versions: VISAM VBASE version 11.6.0.6 Description: The issue arises when VISAM VBASE processes an XML document containing XML entities with URIs that resolve to documents outside of the intended sphere of control. This causes the product to embed...

CVE-2022-2458

An XML external entity injectionXXE vulnerability was found in Business Central. This flaw allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. T...

The vulnerability of the Thunderbird email client and the Firefox ESR browser lies in a error during the processing of CSS style sheets accessible through internal URIs, such as “resource:”. This allows attackers to circumvent the implemented content security policies.

The vulnerability of the Thunderbird email client and the Firefox ESR browser is related to an error in processing CSS style sheets that are accessed through internal URIs, as “resource:”. Exploiting this vulnerability can allow a malicious actor to bypass implemented content security policies...

CVE-2022-32269

In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages displayed by Internet Explorer core. This leads to arbitrary code execution...

Mozilla Firefox Security Feature Issue Vulnerability (CNVD-2023-06862)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security feature issue vulnerability exists in Mozilla Thunderbird that stems from an error when handling CSS stylesheets that are accessible via internal URIs. An attacker could exploit this...

Istio ReDoS Vulnerability

Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API...

GHSA-PGWP-F3XH-M24G Bagisto CSRF Vulnerability

Bagisto before 0.1.5 allows CSRF under /admin URIs...

Bagisto CSRF Vulnerability

Bagisto before 0.1.5 allows CSRF under /admin URIs...

maven:3.6 security and enhancement update

httpcomponents-client 4.5.10-4 - Fix incorrect handling of malformed authority component in request URIs - Resolves: CVE-2020-13956 maven 1:3.6.2-7 - Add maven-openjdk17 - Resolves: rhbz1991521...

GHSA-HQ4R-47QC-3JHC MicroPyramid Django-CRM CSRF

MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users//edit/, and /accounts//delete/ URIs...

AlmaLinux 8 : python-lxml (ALSA-2022:1932)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2022:1932 advisory. - lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content...

RHEL 8 : maven:3.6 (RHSA-2022:1860)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1860 advisory. Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's build...

apache-httpclient: incorrect handling of malformed authority component in request URIs

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution...

RLSA-2022:1860 Moderate: maven:3.6 security and enhancement update

Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fixes: apache-httpclient: incorrect handling of malformed authority...

CVE-2022-27806

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration GC all versions prior to 9.0, when running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance...