GHSA-6C8C-F2W2-JVJR Alkacon OpenCMS XSS via homelink, workplaceresource, mode and query parameters

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...

Subrion CMS CSRF Vulnerability

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...

GHSA-RC94-7V55-WMG6 Subrion CMS CSRF Vulnerability

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...

Improper Input Validation in Apache Hadoop

HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0...

CVE-2022-28077

Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting XSS vulnerability in the Admin panel via the $GET's' parameter...

CVE-2022-27183

The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platfo...

CVE-2022-27183: Improper Neutralization of Input During Web Page Generation

The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platfo...

PT-2022-18274

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.1.4 Description The issue concerns a Reflected XSS in a query parameter within the Monitoring Console app when configured in Distributed mode. This app is bundled with Splunk Enterprise and is not...

Alkacon OpenCms XSS via query parameter in a search action

Cross-site scripting XSS vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action...

CVE-2022-29810

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter...

Design/Logic Flaw

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter...

CVE-2022-29810

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter...

CVE-2022-29810

CVE-2022-29810 affects the HashiCorp go-getter library, where versions before 1.5.11 fail to redact an SSH private key in a URL query parameter. In practice, this can lead to exposure of SSH credentials in logs or error messages, potentially readable by local users with access to the logfile. Con...

CVE-2022-29810: Insertion of Sensitive Information into Log File

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter...

Cross-site Scripting (XSS)

Overview whoogle-search is a Self-hosted, ad-free, privacy-respecting metasearch engine Affected versions of this package are vulnerable to Cross-site Scripting XSS via the query string parameter q. In the case where it does not contain the http string, it is used to build the errormessage that i...

Exrick XMall 跨站脚本漏洞

Exrick XMall is a distributed e-commerce shopping mall based on SOA architecture. A security vulnerability exists in the Exrick XMall Admin Panel, which originates from a GET parameter in product-add.jsp...

Subrion CMS 跨站脚本漏洞

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into websites and supports multiple extension plugins, etc. A security vulnerability exists in Subrion CMS 4.2.1, which can be exploited by attackers via the q parameter in the Kickstart...

The vulnerability of the downloadLogFiles function in the industrial food industry management server application AK-EM 800 allows a hacker to execute arbitrary SQL queries.

The vulnerability of the downloadLogFiles function in the industrial food industry management server application AK-EM 800 relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries through the...

PT-2022-8590

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1 Description A Cross Site Scripting XSS issue exists via the q parameter in the Kickstart template, allowing for potential malicious script execution. Recommendations For Subrion CMS version 4.2.1, consider disabling t...

Jenkins GitLab Authentication Plugin User Redirection Vulnerability

Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A user redirection vulnerability exists in Jenkins GitLab Authentication Plugin 1.13 and earlier versions, which stems fr...