CVE-2022-27422

A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...

PT-2022-10519

Name of the Vulnerable Software and Affected Versions openstack-nova affected versions not specified Description A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL. This issue is also related to...

The vulnerability of the application for identifying, analyzing, and visualizing business risks in IBM Data Risk Manager stems from deficiencies in checking the path name to the restricted access catalog. This allows attackers to write arbitrary files.

The vulnerability of the IBM Data Risk Manager application for identifying, analyzing, and visualizing business risks is related to deficiencies in checking the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to upload...

CVE-2020-21658

A Cross-Site Request Forgery CSRF in WDJA CMS v1.5.2 allows attackers to arbitrarily add administrator accounts via a crafted URL...

GHSA-8VFW-V2JV-9HWC Reflected cross-site scripting in development mode handler in Vaadin

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 Vaadin 14.0.0 through 14.6.1, 3.0.0 through 6.0.9 Vaadin 15.0.0 through 19.0.8 allows local user to execute arbitrary JavaScript code by opening crafted URL in browser. -...

Bosch IP cameras 输入验证错误漏洞

Bosch IP cameras is a German Bosch web camera. Bosch IP cameras is vulnerable to an input validation error that could be exploited by an attacker to inject arbitrary HTTP request headers via a crafted URL...

CVE-2021-20708

NEC Aterm devices Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier allow authenticated attackers to execute arbitrary OS commands by sending a specially crafted request to a specific URL...

CVE-2021-21514

Dell EMC OpenManage Server Administrator OMSA versions 9.5 and prior contain a path traversal vulnerability. A remote user with admin privileges could potentially exploit this vulnerability to view arbitrary files on the target system by sending a specially crafted URL request...

Sourceforge PhpGACL Cross-Site Scripting Vulnerability

Sourceforge PhpGACL is a pluggable platform based on Php, Mysql used to provide access control for platforms organized by Sourceforge. A security vulnerability exists in phpGACL 3.3.7, which can be exploited by an attacker who can provide a crafted URL to trigger the vulnerability...

LOGITEC CORPORATION LAN-W300N/PR5B Security Breach

A security vulnerability exists in the LOGITEC CORPORATION LAN-W300N / PR5B. When a user logged into the device management web page accesses a specially crafted URL, a denial of service may result...

CVE-2020-5540

Cross-site scripting vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to inject arbitrary script or HTML via a specially crafted URL...

PT-2020-4258 · Google · Google Chrome

Name of the Vulnerable Software and Affected Versions: Google Chrome on iOS versions prior to 83.0.4103.88 Description: The issue is related to insufficient policy enforcement in the Omnibox component of Google Chrome on iOS, allowing a remote attacker to perform domain spoofing via a crafted URI...

Cisco Umbrella Injection Vulnerability

Cisco Umbrella is a suite of cloud security platforms from Cisco. The platform prevents cyber threats such as phishing, malware and ransomware. Cisco Umbrella suffers from an injection vulnerability that stems from the program not adequately validating user-submitted input. An attacker could...

git: Crafted URL containing new lines, empty host or lacks a scheme can cause credential leak

A flaw was found in git where credentials can be leaked through the use of a crafted URL. The crafted URL must contain a newline, empty host, or lack a scheme so that the credential helper is fulled into giving the information of a different host to the client. The highest threat from this...

git: Crafted URL containing new lines, empty host or lacks a scheme can cause credential leak

A flaw was found in git where credentials can be leaked through the use of a crafted URL. The crafted URL must contain a newline, empty host, or lack a scheme so that the credential helper is fulled into giving the information of a different host to the client. The highest threat from this...

git: Crafted URL containing new lines can cause credential leak

A flaw was found in git. Credentials can be leaked through the use of a crafted URL that contains a newline, fooling the credential helper to give information for a different host. Highest threat from the vulnerability is to data confidentiality...

git: Crafted URL containing new lines can cause credential leak

A flaw was found in git. Credentials can be leaked through the use of a crafted URL that contains a newline, fooling the credential helper to give information for a different host. Highest threat from the vulnerability is to data confidentiality...

VMware vRealize Log Insight Input Validation Error Vulnerability

VMware vRealize Log Insight provides real-time log management capabilities for VMware environments. An input validation error vulnerability exists in VMware vRealize Log Insight, which stems from the program's inability to properly validate user input. An attacker could exploit the vulnerability...

CVE-2019-15278

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to bypass authorization and access sensitive information related to the device. The vulnerability exists because the software fails to sanitize URLs before it handles requests. A...

Cerberus FTP Server Cross-Site Scripting Vulnerability (CNVD-2020-07242)

Cerberus FTP Server is a multi-channel Windows FTP server, in addition to containing regular FTP features, it also provides users with file access and management privileges, connection limitations, time, IP access, multi-path priority settings and more. A cross-site scripting vulnerability exists...