984 matches found
CVE-2024-39598
SAP CRM WebClient UI Framework allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the applicati...
CVE-2024-25639
Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting XSS via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by...
Malicious code in Tessa.Web.Client.Net (NuGet)
--- -= Per source details. Do not edit below this line.=-...
cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials
A vulnerability was found in cloudevents/sdk-go. This issue involves using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper results in the go-sdk leaking credentials to arbitrary endpoints. When the transport is populated with an authenticated...
SFTPGo Security Vulnerabilities
SFTPGo is a full-featured and highly configurable SFTP server by Nicola Murino, a personal developer in Italy. A security vulnerability exists in SFTPGo versions v2.2.0 through v2.6.1, which stems from the SFTPGo WebAdmin and WebClient support for password reset, which, if enabled, allows even...
CVE-2024-34686
Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify...
PT-2024-25822 · Envoy · Envoy
Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: The issue is related to an out-of-memory OOM vector exposed by Envoy, a cloud-native, open source edge and service proxy. This occurs because the async HTTP client buffers the response with a...
The vulnerability of the user interface of the SAP CRM WebClient UI, which allows an attacker to perform XSS attacks.
The vulnerability of the SAP CRM WebClient UI user interface lies in the lack of security measures taken to protect the web page structure. Exploiting this vulnerability allows an attacker to execute XSS attacks remotely...
io.vertx/vertx-core: memory leak due to the use of Netty FastThreadLocal data structures in Vertx
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge,...
python-urllib3: Cookie request header isn't stripped during cross-origin redirects
A flaw was found in urllib3, a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, which is the responsibility of the user. However, it is possible for a user to specify a Cookie header and...
Mattermost crashes web clients via a malformed custom status
Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status...
CVE-2024-4182
Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status...
Mattermost 代码问题漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that originates from an authenticated attacker being able to access the web client via a misformatted customized state. The vulnerability affects the...
CVE-2024-28287
A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL...
GBG Instinct 安全漏洞
GBG Instinct is an advanced anti-fraud and compliance management solution from GBG. A security vulnerability exists in the GBG Instinct UI Web Client version 6.5.0 that stems from an open redirection vulnerability in the returnUrl parameter, which allows an attacker to redirect users to a malicio...
CVE-2024-28287
A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL...
PT-2024-22381 · Unknown · Instinct Ui Web Client
Name of the Vulnerable Software and Affected Versions: INSTINCT UI Web Client version 6.5.0 Description: A DOM-based open redirection in the returnUrl parameter allows attackers to redirect users to malicious sites via a crafted URL. Recommendations: For INSTINCT UI Web Client version 6.5.0,...
CVE-2024-28287
CVE-2024-28287 describes a DOM-based open redirection in the INSTINCT UI Web Client, version 6.5.0, where the returnUrl parameter can be manipulated to redirect users to attacker‑controlled sites. The issue is documented across multiple feeds (NVD, Red Hat, CVE lists) with the same root cause: im...
