K23124150: GeoIP vulnerability CVE-2018-5521

Security Advisory Description Carefully crafted URLs can be used to reflect arbitrary content into GeoIP lookup responses, potentially exposing clients to XSS. CVE-2018-5521 Impact BIG-IP Clients accessing the affected system may be exposed to cross-site scripting XSS attacks. This vulnerability...

SUSE CVE-2006-3747

Off-by-one error in the ldap scheme handling in the Rewrite module modrewrite in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via...

SUSE CVE-2013-0256

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting XSS attacks via a crafted URL...

SUSE CVE-2016-1627

The Developer Tools aka DevTools subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted...

SUSE CVE-2020-11008

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260GHSA-qm7j-c969-7j4q. The fix for that bug still left the door open for an exploit where some credential is leaked but...

GHSA-QPM3-VR34-H8W8 Open Redirect in Caddy

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs...

Open redirect

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs...

CVE-2022-28923

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs...

Caddy 输入验证错误漏洞

Caddy is an open source, cross-platform HTTP/Web server from Caddy. A security vulnerability exists in Caddy version v2.4.6. An attacker exploited the vulnerability to redirect users to phishing websites via specially crafted URLs...

CVE-2022-28923

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs...

CVE-2022-28923

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs...

CVE-2022-28923

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs...

webbrowser 路径遍历漏洞

webbrowser is a Rust library by the individual developer Amod Malviya for opening URLs in web browsers available on the platform. A security vulnerability exists in rust-lang webbrowser-rs version v0.8.2, which stems from its IpFile parameter that allows an attacker to access arbitrary files via ...

CVE-2022-45429

Some Dahua software products have a vulnerability of server-side request forgery SSRF. An Attacker can access internal resources by concatenating links URL that conform to specific rules...

CVE-2022-43140

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...

Server side request forgery (ssrf)

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...

CVE-2022-43140

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery SSRF via the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url paramete...

PT-2022-6261 · Cisco · Cisco Asyncos Software For Cisco Email Security Appliance

Name of the Vulnerable Software and Affected Versions: Cisco AsyncOS Software for Cisco Email Security Appliance ESA affected versions not specified Description: A vulnerability in the URL filtering mechanism could allow an unauthenticated, remote attacker to bypass the URL reputation filters on ...

Aruba Networks ClearPass Policy Manager 跨站请求伪造漏洞

Aruba Networks ClearPass Policy Manager is an Aruba Networks application that provides a secure access management system for wireless networks. A security vulnerability exists in Aruba Networks ClearPass Policy Manager versions 6.10.x through 6.10.6 and 6.9.x through 6.9.11. An attacker could...

Dataprobe iBoot-PDU 代码问题漏洞

The Dataprobe iBoot-PDU is a web-accessible managed PDU independently controlled outlet from Dataprobe USA. A code issue vulnerability exists in the Dataprobe iBoot-PDU FW that stems from the fact that an attacker can create URLs capable of changing host parameters via a carefully crafted PHP...