Prototype Pollution

Templ8 is vulnerable to prototype pollution. A lack of validation when parsing query strings via the parse function allows an attacker to inject arbitrary objects and execute arbitrary code...

CVE-2020-15337

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests...

CVE-2020-15338

CVE-2020-15338 affects Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1. The issue is “Use of GET Request Method With Sensitive Query Strings” on /cnr, exposing sensitive information via GET parameters. The CVE lists a MEDIUM base score (CVSS 3.1: AV Network, AC Low, PR None, UI None, C I Low). Practic...

CVE-2020-15338

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests...

CVE-2020-15338: Missing Authorization

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests...

CVE-2020-15337: Missing Authorization

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests...

CVE-2014-5138: Undefined Security Weakness

Innovative Interfaces Sierra Library Services Platform 1.23 does not properly handle query strings with multiple instances of the same parameter, which allows remote attackers to bypass parameter validation via unspecified vectors, possibly related to the Webpac Pro submodule...

Prototype Pollution

mithrill is vulnerable to prototype pollution. A lack of validation when parsing query strings allow an attacker to inject arbitrary objects and execute arbitrary code...

CVE-2019-6531: Use of GET Request Method With Sensitive Query Strings

An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 or Software Version 1.1.13166 if the attacker is in an MITM position...

WordPress PayPal Checkout Payment Gateway 1.6.8 Plugin - Parameter Tampering Vulnerability

Exploit for php platform in category web applications WordPress PayPal Checkout Payment Gateway 1.6.8 Plugin - Parameter Tampering Exploit Title: cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter...

Arbitrary Code Execution

php-cgi is susceptible to arbitrary code execution. An attacker can inject arbitrary script because it does not properly handle the query strings without an = equals sign character, leading to malicious code execution with the privileges of the PHP interpreter...

CVE-2018-18248

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...

CVE-2018-14822

Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, which may allow an attacker to impersonate a legitimate user and execute arbitrary code...

CVE-2018-14822

Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, which may allow an attacker to impersonate a legitimate user and execute arbitrary code...

CVE-2018-14822

CVE-2018-14822 affects Entes EMG12 Ethernet Modbus Gateway firmware v2.57 and earlier. The vulnerability is an information exposure through query strings in the web interface, which may allow an attacker to impersonate a legitimate user and, per the connected sources, execute arbitrary code. The ...

CVE-2018-14822: Use of GET Request Method With Sensitive Query Strings

Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, which may allow an attacker to impersonate a legitimate user and execute arbitrary code...

Cross site request forgery (csrf)

An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An information exposure through query strings vulnerability in the web interface has been identified, which...

CVE-2018-5467

An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An information exposure through query strings vulnerability in the web interface has been identified, which...

CVE-2018-5467

CVE-2018-5467 affects Belden Hirschmann Classic Platform Switches (RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, OCTOPUS all versions). It is an Information Exposure Through Query Strings in GET Request vulnerability in the web interface, potentially enabling an attacker to impersonate a legitim...

CVE-2018-5467

An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An information exposure through query strings vulnerability in the web interface has been identified, which...