4860 matches found
F5 BIG-IQ 跨站脚本漏洞
F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing from F5 USA. A cross-site scripting vulnerability exists in BIG-IQ, which could be exploited by an attacker using a specially crafted URL to reflect...
CVE-2020-5016
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. When application security is disabled and JAX-RPC applications are present, an attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to vi...
CVE-2021-20668
Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL...
PT-2021-6654
Name of the Vulnerable Software and Affected Versions Microsoft Teams affected versions not specified Description The issue is related to errors in the representation of information by the user interface, which can be exploited by a remote attacker to conduct spoofing attacks using a specially...
Weseek GROWI 路径遍历漏洞
GROWI is a team collaboration software. A path traversal vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited to read arbitrary paths via a specially crafted URL...
GHSA-C4QR-GMR9-V23W Prefix escape
Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...
Prefix escape
Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...
fastify-http-proxy 输入验证错误漏洞
Docs fastify-http-proxy is Docs an open source application . It is used to forward all incoming requests with a given prefix or no prefix to the upstream. A security vulnerability exists in fastify-http-proxy that stems from the ability to escape the prefix of a proxy backend service by creating ...
CVE-2021-20354
IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 194883...
CVE-2020-7849
A vulnerability of uPrism.io CURIXVideo conferecing solution could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient inputserver domain validation. An attacker could exploit this vulnerability through crafted URL...
CVE-2020-7849
A vulnerability of uPrism.io CURIXVideo conferecing solution could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient inputserver domain validation. An attacker could exploit this vulnerability through crafted URL...
CVE-2020-7849
A vulnerability of uPrism.io CURIXVideo conferecing solution could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient inputserver domain validation. An attacker could exploit this vulnerability through crafted URL...
Code injection
A vulnerability of uPrism.io CURIXVideo conferecing solution could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient inputserver domain validation. An attacker could exploit this vulnerability through crafted URL...
CVE-2020-7849
CVE-2020-7849 affects uPrism.io CURIX (Video conferencing): an unauthenticated attacker could trigger remote arbitrary code execution due to insufficient input validation of the server domain via crafted URLs. The vulnerability arises from improper input validation in the URL handling path. Explo...
CVE-2020-7849: Improper Input Validation
A vulnerability of uPrism.io CURIXVideo conferecing solution could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient inputserver domain validation. An attacker could exploit this vulnerability through crafted URL...
PT-2021-12672
Name of the Vulnerable Software and Affected Versions: uPrism.io CURIX affected versions not specified Description: The issue is due to insufficient input validation of the server domain, allowing an unauthenticated attacker to execute arbitrary code through a crafted URL. Recommendations: At the...
CVE-2021-27229
Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text...
Remote code execution
Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text...
