Design/Logic Flaw

mangadex-downloader is a command-line tool to download manga from MangaDex. When using file: command and is a web URL location http, https, mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains...

CVE-2022-36082

mangadex-downloader is a command-line tool to download manga from MangaDex. When using "file:" command and "" is a web URL location http, https, mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2...

CVE-2022-36082

mangadex-downloader is affected by a vulnerability where, when using the file: command with a web URL location (http, https), versions 1.3.0 through 1.7.2 will attempt to open and read a local disk file for each line of website contents. The issue is mitigated by a patch in version 1.7.2. The pro...

CVE-2022-36082 mangadex-downloader vulnerable to unauthorized file reading

mangadex-downloader is a command-line tool to download manga from MangaDex. When using file: command and is a web URL location http, https, mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains...

mangadex-downloader 输入验证错误漏洞

mangadex-downloader is a command line tool for downloading comics from MangaDex by the individual developer Rahman Yusuf. An input validation error vulnerability exists in versions of mangadex-downloader prior to 1.7.2, which stems from an attempt to open and read a file on local disk for each li...

CVE-2022-34797

A cross-site request forgery CSRF vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials...

SICK FieldEcho 资源管理错误漏洞

SICK FieldEcho is an industrial control product from SICK. A security vulnerability exists in the SICK FieldEcho, which originates from an unauthenticated user being able to access a sensitive web URL via a GET request. an attacker could use the sensitive information to launch further attacks on...

CVE-2020-27197

TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the nonetwork setting is used for the XML parser. NOTE: the vendor points out that the parse method "wraps the lxml library...

Missing permission check in perfecto

perfecto 1.17 and earlier does not perform a permission check in a method implementing a connection test. This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified username and password. perfecto 1.18 requires Overall/Administer...

avatar allows changing other users' avatars

avatar does not implement a permission check for the HTTP URL used to replace user avatars. This allows any user with Overall/Read permission to change any other user's avatar, in addition to their own. As of publication of this advisory, there is no fix...

CVE-2018-0105

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables. An attacker could exploit this vulnerability by browsing to a specific URL. ...

Information disclosure

A vulnerability in the web framework of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a web URL redirect attack against a user who is logged in to an affected system. More Information: CSCvb21745. Known Affected Releases: 10.0R2tanggula...

CVE-2017-3810

A vulnerability in the web framework of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a web URL redirect attack against a user who is logged in to an affected system. More Information: CSCvb21745. Known Affected Releases: 10.0R2tanggula...

PT-2017-16113

Name of the Vulnerable Software and Affected Versions Cisco Prime Service Catalog version 10.0 R2 tanggula Description A vulnerability in the web framework of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a web URL redirect attack against a user who is logge...

Threat Outbreak Alert RuleID26690: Email Messages Distributing Malicious Software on December 5, 2016

Medium Alert ID: 50971 First Published: 2016 December 5 17:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID26690 may contain the following files: Name |...

Users not Being Prompted for Citrix Receiver Upgrade Upon Logon to Storefront Web URL

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Users not being prompted to upgrade Citrix Receiver when it is available...

Threat Outbreak Alert RuleID25158: Email Messages Distributing Malicious Software on September 21, 2016

Medium Alert ID: 48995 First Published: 2016 September 21 18:32 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID25158 may contain the following files: Name ...

Threat Outbreak Alert RuleID24254: Email Messages Distributing Malicious Software on August 12, 2016

Medium Alert ID: 48452 First Published: 2016 August 12 14:05 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24254 may contain the following files: Name |...

Android Instant Apps — Run Apps Quickly Without Installation

Downloading an app is a real pain sometimes when you don't want to install the complete app on your smartphone just for booking a movie ticket, or buying something online. Isn't that? Now, Imagine the world where you can use any Android app without actually the need to download or even install it...

Advanced Electron Forum 1.0.9 - Remote File Inclusion / Cross-Site Request Forgery

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AEF-RFI.txt Vendor: ============================= www.anelectron.com/downloads/ Product: ================================ Advanced Electron Forum v1.0.9 AEF Exploit patched current version...