Improper access control

Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview...

CVE-2022-24923

CVE-2022-24923 affects Samsung SearchWidget prior to 2.3.00.6 on China models. Root cause: improper access control that allows untrusted applications to load arbitrary URLs and local files in a webview. Affected version range: before 2.3.00.6. Remediation: update to version 2.3.00.6 or later. Not...

GitLab Enterprise Edition 和 Community Edition 输入验证错误漏洞

GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. An input validation error vulnerability exists in GitLab Enterprise Edition and Gitlab Community Edition due to improper filtering of user-supplied data in Jir...

The software vulnerabilities of the Ethernet module servers WISE-4060 and Adam-6050 D allow attackers to redirect users to any desired URL address.

The vulnerability of the software for Ethernet server modules WISE-4060 and Adam-6050 D lies in the insufficient protection of web pages. Exploiting this vulnerability can allow a remote attacker to redirect users to any arbitrary URL address...

Siren Investigate 代码问题漏洞

Siren Investigate is a front-end to the Siren platform from Siren Ireland, allowing the creation of dashboards, charts, link analysis, alerts, etc. A cross-site request forgery vulnerability exists in versions of Siren Investigate prior to 11.1.1, which can be exploited by an attacker to specify...

CVE-2021-29102

A Server-Side Request Forgery SSRF vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks...

Server side request forgery (ssrf)

A Server-Side Request Forgery SSRF vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2021-29102 There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.

A Server-Side Request Forgery SSRF vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2021-28060

A Server-Side Request Forgery SSRF vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php...

CVE-2021-28060

A Server-Side Request Forgery SSRF vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php...

Server side request forgery (ssrf)

A Server-Side Request Forgery SSRF vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php...

CVE-2021-28060

A Server-Side Request Forgery SSRF vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php...

CVE-2020-13565

An open redirect vulnerability exists in the returnpage redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2 and OpenEMR development version 6.0.0 commit babec93f600ff1394f91ccd512bcad85832eb6ce. A specially crafted HTTP request can redirect users to an arbitrary URL. An attacker can provide...

PT-2021-9639 · Phpgacl +1 · Phpgacl +1

Name of the Vulnerable Software and Affected Versions: phpGACL version 3.3.7 OpenEMR version 5.0.2 OpenEMR development version 6.0.0 commit babec93f600ff1394f91ccd512bcad85832eb6ce Description: An open redirect issue exists in the return page redirection functionality. A specially crafted HTTP...

Brave Software: Onion-Location header allows to open arbitrary URLs including chrome:

The "Open in Tor" feature in Brave Nightly for OSX allowed arbitrary URLs to be opened through the Onion-Location response header, including privileged URLs such as chrome://restart/. This could be exploited to bypass SOP restrictions and gain access to privileged URLs...

Sourceforge PhpGACL Input Validation Error Vulnerability

Sourceforge PhpGACL is a pluggable platform based on Php, Mysql used to provide access control for platforms organized by Sourceforge. An input validation error vulnerability exists in phpGACL 3.3.7, which stems from an OPEN redirection vulnerability in the return page redirection feature. An...

Android WebView Universal Cross-site Scripting

A universal cross-site scripting UXSS vulnerability, CVE-2020-6506 https://crbug.com/1083819, has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps whic...

GHSA-36J3-XXF7-4PQG Android WebView Universal Cross-site Scripting

A universal cross-site scripting UXSS vulnerability, CVE-2020-6506 https://crbug.com/1083819, has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps whic...

CVE-2020-5784

Server-Side Request Forgery in Teltonika firmware TRB2R00.02.04.3 allows a low privileged user to cause the application to perform HTTP GET requests to arbitrary URLs...

Server-Side Request Forgery in @uppy/companion

Versions of @uppy/companion prior to 1.9.3 are vulnerable to Server-Side Request Forgery SSRF. The get route passes the user-controlled variable req.body.url to a GET request without sanitizing the value. This allows attackers to inject arbitrary URLs and make GET requests on behalf of the server...