Command injection

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests...

CVE-2022-29061

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests...

CVE-2022-22304

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests...

Design/Logic Flaw

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests...

CVE-2022-22304

CVE-2022-22304 describes a cross-site scripting (XSS) vulnerability in FortiAuthenticator OWA Agent for Microsoft, affecting version 2.2 and 2.1. The issue arises from improper neutralization of input during web page generation (CWE-79), allowing an unauthenticated attacker to perform an XSS via ...

CVE-2022-23142

ZXEN CG200 has a DoS vulnerability. An attacker could construct and send a large number of HTTP GET requests in a short time, which can make the product management websites not accessible...

CVE-2022-23142

CVE-2022-23142 concerns ZXEN CG200 and describes a DoS vulnerability: an attacker can flood the device’s management interface with a large number of HTTP GET requests in a short time, causing the product management websites to become inaccessible. The affected device is ZTE ZXEN CG200 (versions a...

IBM Engineering Lifecycle Optimization信息泄露漏洞

IBM Engineering Lifecycle Optimization ELO is an extension of the Engineering Lifecycle Management ELM product portfolio from IBM USA. They make it easier to collect and analyze data from across the development environment to make better decisions. Automate reporting to ensure the entire...

Unspecified Vulnerability in TP-LINK TL-WR841N

The TP-LINK TL-WR841N is a wireless router from China P&L TP-LINK. A security vulnerability exists in the TP-LINK TL-WR841N V12 firmware version 3.16.9, which can be exploited by an authenticated, remote attacker to execute arbitrary code via a GET request to the System Tools page of a Wi-Fi...

CVE-2022-26649

A vulnerability has been identified in SCALANCE X200-4P IRT All versions V5.5.2, SCALANCE X201-3P IRT All versions V5.5.2, SCALANCE X201-3P IRT PRO All versions V5.5.2, SCALANCE X202-2IRT All versions V5.5.2, SCALANCE X202-2IRT All versions V5.5.2, SCALANCE X202-2P IRT All versions V5.5.2, SCALAN...

CVE-2022-26649

The CVE-2022-26649 vulnerability affects multiple Siemens SCALANCE X switches (various models) where incoming HTTP GET URI handling is not properly validated, allowing an unauthenticated remote attacker to crash affected devices. The issue impacts numerous versions across products (e.g., X200-4P ...

PT-2022-17981 · Siemens · Scalance Xf204 +20

Name of the Vulnerable Software and Affected Versions: SCALANCE X200-4P IRT versions prior to V5.5.2 SCALANCE X201-3P IRT versions prior to V5.5.2 SCALANCE X201-3P IRT PRO versions prior to V5.5.2 SCALANCE X202-2IRT versions prior to V5.5.2 SCALANCE X202-2P IRT versions prior to V5.5.2 SCALANCE...

PowerGram - Multiplatform Telegram Bot In Pure PowerShell

PowerGram is a pure PowerShell Telegram Bot that can be run on Windows, Linux or Mac OS. To make use of it, you only need PowerShell 4 or higher and an internet connection. All communication between the Bot and Telegram servers is encrypted with HTTPS, but all requests will be sent in GET method,...

CVE-2022-24414

Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attac...

CVE-2022-24414

Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attac...

Design/Logic Flaw

Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attac...

CVE-2022-24414

Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attac...

CVE-2022-24414

CVE-2022-24414 affects Dell EMC CloudLink 7.1.3 and earlier. The authentication token is exposed in GET request parameters, which can be logged by reverse proxies and servers, potentially allowing attackers to access the CloudLink server. The underlying issue is insecure token usage in URLs. Expe...

GHSA-MFJW-X4Q4-69P9 Ignite Realtime Openfire vulnerable to Server Side Request Forgery

A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. The issue is fixed in version 4.5.0-beta...

Ignite Realtime Openfire vulnerable to Server Side Request Forgery

A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. The issue is fixed in version 4.5.0-beta...