Skip to content

TechMedia

Header Image
Category

HIGH

385 Posts

Featured

Posted byWpmaster
[Microsoft.NetCore.App.Runtime.win-arm] .NET Remote Code Execution Vulnerability
Posted byWpmaster
[github.com/traefik/traefik/v2] Traefik HTTP header parsing could cause a denial of service
Posted byWpmaster
[github.com/answerdev/answer] Answer vulnerable to Exposure of Sensitive Information Through Metadata
Posted byWpmaster
[github.com/answerdev/answer] Answer vulnerable to Insertion of Sensitive Information Into Sent Data

[taffydb] TaffyDB can allow access to any data items in the DB

  • Posted inHIGH
  • Posted byWpmaster
  • 02/20/202001/31/2023

TaffyDB allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. Taffy sets an internal index for each data item in its DB. However, it is found that the internal inde…

[org.springframework:spring-webmvc] RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

  • Posted inHIGH
  • Posted byWpmaster
  • 01/22/202012/16/2022

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header in the response w…

[tough-cookie] Regular Expression Denial of Service in tough-cookie

  • Posted inHIGH
  • Posted byWpmaster
  • 07/25/201804/04/2023

Affected versions of tough-cookie are susceptible to a regular expression denial of service.
The amplification on this vulnerability is relatively low – it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters…

[sanitize] Sanitize vulnerable to Improper Input Validation and Cross-site Scripting

  • Posted inHIGH
  • Posted byWpmaster
  • 03/21/201810/20/2022

When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements.
This can allow…

[lynx] lynx doesn’t properly sanitize user input and exposes database password to unauthorized users

  • Posted inHIGH
  • Posted byWpmaster
  • 01/25/201801/24/2023

The lynx gem prior to 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.
As of version 1.0.0, lynx no longer supports a –password option. Passwords are only co…

Posts navigation

Previous Posts 1 … 37 38 39
TechMedia
WordPress theme by componentz

Archives

2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30
Hit enter to search or ESC to close