CVE-2020-13662

Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions...

CVE-2021-28125

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click...

PYSEC-2021-128

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click...

CVE-2021-28125

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click...

Open redirect

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click...

CVE-2021-28125 Apache Superset Open Redirect

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click...

CVE-2021-28125

CVE-2021-28125 affects Apache Superset up to and including 1.0.1. The issue is an open redirect in the URL shortener functionality caused by not validating user input, enabling a malicious user to craft a short URL for a dashboard that could deceive users into clicking it. Connected advisories co...

Apache Superset up 输入验证错误漏洞

Apache Superset up is the United States Apache company to provide a large distributed environment in the horizontal scaling design applications. An input validation error vulnerability exists in Apache Superset 1.0.1 and earlier versions, which arises from unchecked user input that opens a redire...

Osi.Ig - Information Gathering Instagram

The Instagram OSINT Tool gets a range of information from an Instagram account that you normally wouldn't be able to get from just looking at their profile The information includes: profile : user id, followers / following, number of uploads, profile img URL, business enum, external URL, joined...

lcfe.ie Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1100618 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting lcfe.ie website and its...

Malicious Package

celcius is a package that can be used to perform malicious activities. The package contains an example script that downloads a file from a third-party and builds a command to be executed. While the file iris.data appears to be non-malicious, it can be altered at any point of time to contain...

Cross-Site Request Forgery (CSRF)

Kibana is vulnerable to Cross-Site Request Forgery. There is no restriction in graphite.url configuration. Thus, an attacker with administrative Kibana access could set the timelion:graphite.url configuration option to an arbitrary URL, possibly leading to an attacker accessing external URL...

CVE-2019-7616

Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery SSRF flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana access could set the timelion:graphite.url configuration option to an arbitrary URL. This could possibly lead to an...

Code injection

In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archive containing a config.php file, hosting the .zip file at an external URL, and visiting index.php?r=appmanage/index/onlineinstall&url=...

Debian DLA-1550-1 : drupal7 security update

It was discovered that there was a remote code execution and an external URL injection vulnerability in the Drupal content management framework. For more information, please see : https://www.drupal.org/sa-core-2018-006 For Debian 8 'Jessie', these issues have been fixed in drupal7 version...

Debian: Security Advisory (DLA-1550-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Drupal Core - Multiple Vulnerabilities - SA-CORE-2018-006

Content moderation - Moderately critical - Access bypass - Drupal 8 In some conditions, content moderation fails to check a users access to use certain transitions, leading to an access bypass. In order to fix this issue, the following changes have been made to content moderation which may have...

CVE-2018-16307

An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi55DD Version 2.8.50 devices. It is possible to induce the application to retrieve the contents of an arbitrary external URL and return those contents in its own response. If a domain name containing a random string is used...

Ramco mHub - Customized SSL, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Ramco mHub published at the 'play' market has multiple vulnerabilities...

Outlook Home Page – Another Ruler Vector

Ruler has become a go to tool for us on external engagements, easily turning compromised mailbox credentials into shells. This has resulted in security being pushed forward and Microsoft responding with patches for the two vectors used in Ruler, namely rules and forms. These were patched with...