Vulnerability of the HTTP client function in Cisco IOS and Cisco IOS XE operating systems, allowing attackers to read or modify arbitrary data

The vulnerability of the HTTP client function in Cisco IOS and Cisco IOS XE operating systems lies in the fact that information about the TCP port is not considered when comparing new requests with existing persistent HTTP connections. Exploiting this vulnerability allows a remote attacker to rea...

Cisco IOS and IOS XE HTTP Client Resource Management Error Vulnerability

Cisco IOS and IOS XE are a set of operating systems developed by Cisco for its network devices. A resource management error vulnerability exists in the HTTP client functionality in Cisco IOS and IOS XE, which arises from a program that does not take into account TCP port information when matching...

DEBIAN-CVE-2017-18635

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name...

CVE-2019-12665

A vulnerability in the HTTP client feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to read and modify data that should normally have been sent via an encrypted channel. The vulnerability is due to TCP port information not being considered when matching new...

UBUNTU-CVE-2019-15052

The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007...

Fedora Update for squid FEDORA-2019-cb50bcc189

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Steam Windows Client - Local Privilege Escalation

Steam Windows Client - Local Privilege Escalation $SteamRegKey = "HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\NSIS" $MSIRegKey = "HKLM:\SYSTEM\CurrentControlSet\Services\msiserver" $RegDir = "C:\Windows\Temp\RegLN.exe" $PayDir = "C:\Windows\Temp\payload.exe" $Payload = "c:\windows\system32\cmd.exe /c...

Adobe Creative Cloud Web Client Detection

Binary data 700746.prm...

CVE-2018-18836

An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of webclientapirequestv1data in web/api/webapiv1.c...

CVE-2018-18837

An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of webclientapirequestv1data in web/api/webapiv1.c...

CVE-2018-18837

CVE-2018-18837 affects Netdata 1.10.0 and is described as HTTP Header Injection via the api/v1/data filename parameter due to web_client_api_request_v1_data in web/api/web_api_v1.c. The vulnerability is categorized as a header injection issue (CVSS details shown in the entry: CVSSv3 base score 6....

Zimbra Web Client (ZWC) Cross-Site Scripting Vulnerability

Zimbra Collaboration Suite ZCS is an open source collaboration suite from the American company Zimbra. The product includes WebMail, Calendar, Address Book, etc. Zimbra Web Client ZWC is one of the e-mail client program. A cross-site scripting vulnerability exists in the briefcase component of ZW...

CVE-2018-14425

CVE-2018-14425 concerns a Persistent XSS vulnerability in the Zimbra Web Client’s briefcase component within Zimbra Collaboration Suite (ZCS). Affected versions are ZCS/ZWC 8.8.8 prior to Patch 7 and 8.8.9 prior to Patch 1. The root cause is improper handling/validation of client-side data in the...

CVE-2018-14425: Improper Neutralization of Input During Web Page Generation

There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite ZCS Zimbra Web Client ZWC 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1...

Billions of Malicious Bots Attacks Take to Cipher-Stunting to Hide

When it comes to cyberattacks, adversaries are focusing not just on advanced malware development, but also on increasing the sophistication of their evasion techniques. This is playing out lately in the form of ballooning instances of “cipher stunting” – a TLS tampering technique that helps...

CVE-2019-3489

An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to...

CVE-2019-3489

An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to...

PT-2019-16596

Name of the Vulnerable Software and Affected Versions Micro Focus Content Manager versions 9.1 through 9.3 Description An unauthenticated file upload issue has been identified in the Web Client component when configured to use the ADFS authentication method. This could be exploited by an...

CVE-2019-3489: Unrestricted Upload of File with Dangerous Type

An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to...

Suspicious JavaScript Obfuscation Chunks Technique

Known exploits could potentially bypass security products by using JavaScript obfuscation techniques. Obfuscated exploits might not be detected by IDS and IPS systems, thus allowing attackers to successfully attack the target web client...