2096 matches found
GHSA-V858-922F-FJ9V SimpleSAMLphp Link Injection vulnerability
Background Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out. Description The following scripts we...
PT-2024-40365 · Cms · Cms
Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned, so: CMS affected versions not specified Description: The issue is due to a lack of parameter sanitisation, allowing a carefully crafted URL to inject arbitrary HTML into the CMS Edit page. An attack...
CVE-2024-20383
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An...
CVE-2024-20256
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient...
CVE-2024-20257
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface.r This vulnerability is due to insufficient validation of user input. An attacker...
CVE-2024-20256
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient...
CVE-2024-20369
CVE-2024-20369 affects Cisco Crosswork Network Services Orchestrator (NSO) Web UI. The issue is improper input validation of a parameter in an HTTP request, enabling an unauthenticated, remote attacker to persuade a user to click a crafted link and be redirected to a malicious website. Documented...
CVE-2024-20369
A vulnerability in the web-based management interface of Cisco Crosswork Network Services Orchestrator NSO could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of a parameter in an HTTP request. An...
PT-2024-4561 · Cisco · Cisco Asyncos
Name of the Vulnerable Software and Affected Versions: Cisco AsyncOS Software for Cisco Secure Email Gateway affected versions not specified Description: The issue is related to insufficient validation of user input in the web-based management interface, allowing an authenticated, remote attacker...
PT-2024-19445 · Jfrog · Jfrog Platform
Name of the Vulnerable Software and Affected Versions: JFrog platform versions prior to 7.85.0 SaaS JFrog platform versions prior to 7.84.7 Self-Hosted Description: A Header Injection issue may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent t...
The vulnerability of the QTS operating system’s network storage solutions on QNAP allows attackers to carry out XSS attacks.
The vulnerability of the QTS operating system and QNAP network storage devices exists due to insufficient data cleaning. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using a specially created link...
PT-2024-4483 · Lenovo · Lenovo Service Bridge
Name of the Vulnerable Software and Affected Versions: Lenovo Service Bridge versions prior to 5.0.2.17 Description: A privilege escalation issue was reported that could allow operating system commands to be executed if a specially crafted link is visited. The vulnerability is related to the...
PT-2024-24193 · Minicms · Minicms
Name of the Vulnerable Software and Affected Versions: MiniCMS version 1.11 Description: A Cross Site Scripting issue allows a remote attacker to run arbitrary code via a crafted string in the URL after login. Recommendations: For MiniCMS version 1.11, update to a version that includes a fix for...
CVE-2024-3872
Mattermost Mobile app versions 2.13.0 and earlier are affected by a vulnerability in the deep-link parsing logic, where a regular expression with polynomial complexity can be exploited by an unauthenticated remote attacker to freeze or crash the app via a long maliciously crafted link. The issue ...
PT-2024-3939 · Microsoft · Azure Monitor Agent
Name of the Vulnerable Software and Affected Versions: Azure Monitor Agent affected versions not specified Description: The issue is related to an incorrect reference count before accessing a file, which can be exploited to elevate privileges using a specially crafted link. Recommendations: At th...
VulnCheck KEV: CVE-2018-17431
Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL...
CVE-2024-22721
Cross Site Request Forgery CSRF vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link...
CVE-2024-22721
Cross Site Request Forgery CSRF vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link...