CVE-2023-37279

Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web...

CVE-2023-37279 Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input

Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web...

CVE-2023-37279: Allocation of Resources Without Limits or Throttling

Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web...

CVE-2023-23957

An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4...

CVE-2023-23957 Open Redirection Vulnerability in Symantec Identity Portal 14.4

An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4...

CVE-2023-23957

CVE-2023-23957 affects Symantec Identity Portal 14.4. An authenticated user can see and modify the value of the ‘next’ query parameter, which corresponds to an open redirection vulnerability in Symantec Identity Portal 14.4. The available documents state the impact as an ability to view/modify th...

CVE-2023-23957 Open Redirection Vulnerability in Symantec Identity Portal 14.4

An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4...

CVE-2023-23957: URL Redirection to Untrusted Site

An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4...

PT-2023-19323

Name of the Vulnerable Software and Affected Versions Symantec Identity Portal version 14.4 Description An authenticated user can see and modify the value for the next query parameter. Recommendations For Symantec Identity Portal version 14.4, consider restricting access to the next query paramet...

Symantec Identity Portal Input Validation Error Vulnerability

Symantec Identity Portal is an identity and access management from Symantec USA. A security vulnerability exists in Symantec Identity Portal version 14.4. An attacker could view and modify the value of the "next" query parameter...

CVE-2023-40958

A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management aka pdm v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the query parameter in models/baseclient.py component...

CVE-2023-40958

A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management aka pdm v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the query parameter in models/baseclient.py component...

CVE-2023-40958

A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management aka pdm v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the query parameter in models/baseclient.py component...

CVE-2023-41930

Jenkins Job Configuration History Plugin 1227.v7a79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin...

PT-2023-28170

Name of the Vulnerable Software and Affected Versions Jenkins Job Configuration History Plugin versions 1227.v7a 79fc4dc01f and earlier Description The issue allows attackers to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called...

CVE-2023-41930: Improper Limitation of a Pathname to a Restricted Directory

Jenkins Job Configuration History Plugin 1227.v7a79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin...

CVE-2023-4173

A vulnerability, which was classified as problematic, was found in mooSocial mooStore 3.1.6. Affected is an unknown function of the file /search/index. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this...

CVE-2023-36825

Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the "state" query paramete...

golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters

A flaw was found in the golang package, where requests forwarded by reverse proxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This issue could permit query parameter smuggling when a Go proxy forwards a parameter with an...

miniCal SQL注入漏洞

miniCal is miniCal open source an open source PMS. miniCal version 1.0.0 SQL injection vulnerability , the vulnerability stems from the file /booking/showbookings/ parameter searchquery lack of validation of external input SQL statements , an attacker can use this vulnerability to execute illegal...