135 matches found
CVE-2025-33014 IBM Sterling B2B Integrator and IBM Sterling File Gateway link injection
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the...
CVE-2025-33014
CVE-2025-33014 affects IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.0.0.0–6.1.2.7 and 6.2.0.0–6.2.0.4. Root cause: the product uses a web link to an external site with untrusted references (CWE-1022). Impact: potential information disclosure or unauthorized actions in the ...
CVE-2025-33014 IBM Sterling B2B Integrator and IBM Sterling File Gateway link injection
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the...
CVE-2010-2324
IBM WebSphere Application Server WAS 7.0 before 7.0.0.11 on z/OS allows attackers to perform unspecified "link injection" actions via unknown vectors...
CVE-2025-25245
SAP BusinessObjects Business Intelligence Platform Web Intelligence contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a...
SAP BusinessObjects Business Intelligence Platform 跨站脚本漏洞
SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly and...
CVE-2024-8741
The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to inject...
PT-2024-6824 · Sap · Sap Netweaver Application Server Abap
Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP affected versions not specified Description: The issue allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by the server...
Link Injection
Apache Airflow is vulnerable to Link Injection. The vulnerability is due to improper validation for urls in the provider list within the file views.py, which allows an authenticated attacker to inject a malicious link when installing a provider...
PYSEC-2024-189
Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue...
Security Bulletin: IBM Security QRadar EDR Software has multiple vulnerabilities (CVE-2023-35006, CVE-2023-33859, CVE-2023-33860, CVE-2023-35008)
Summary IBM Security QRadar EDR Software is vulnerable to link injection and could also allow an attacker to embed links URLs to an external site or to different pages. Sensitive information could also be disclosed due to an observable login response discrepancy and web pages could be stored...
SimpleSAMLphp Link Injection vulnerability
Background Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out. Description The following scripts we...
GHSA-V858-922F-FJ9V SimpleSAMLphp Link Injection vulnerability
Background Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out. Description The following scripts we...
CVE-2023-34203
In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...
Evento Multivendor Event Ticket Booking 1.0 Cross Site Scripting
┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...
SUSE CVE-2017-6932
Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an externa...
CVE-2022-39376
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in mailto links. This issue has been patched, please...
Security Bulletin: IBM Business Process Manager (BPM) Vulnerable URLs (CVE-2013-0581)
Abstract When a dashboard is opened or a service is executed, a malicious attacker can intercept network requests from the client. Then, the attacker can modify the URL parameters of the request so that malicious code can be executed within the client browser. Content VULNERABILITY DETAILS:...
SAP NetWeaver Development Infrastructure 跨站脚本漏洞
SAP NetWeaver Development Infrastructure is an SAP company that provides a consistent development environment, development teams, and support for software development throughout the product lifecycle. A cross-site scripting vulnerability exists in SAP NetWeaver Development Infrastructure, which c...