308 matches found
CVE-2024-0509
The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘request’ parameter in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
PT-2024-15625 · WordPress · Wp 404 Auto Redirect To Similar Post
Name of the Vulnerable Software and Affected Versions: WP 404 Auto Redirect to Similar Post plugin for WordPress versions up to, and including, 1.0.3 Description: The issue is related to Reflected Cross-Site Scripting via the request parameter due to insufficient input sanitization and output...
Cross site scripting
Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests...
CVE-2023-6838
The CVE-2023-6838 entry describes a reflected Cross-Site Scripting vulnerability in the Authentication Endpoint of WSO2 API Manager. An attacker can tamper a request parameter to execute script in the context of a victim’s browser, with impact limited to confidentiality and integrity (per CVSS: L...
CVE-2023-6838
Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests...
CVE-2023-25650
There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads...
Arbitrary file deletion
There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads...
jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()
A flaw was found in the jetty-server package. A servlet with multipart support could get an OutOfMemorryError when the client sends a part that has a name but no filename and substantial content. This flaw allows a malicious user to jeopardize the environment by leaving the JVM in an unreliable...
Nipah Virus Testing Management System Cross-Site Request Forgery Vulnerability
Nipah Virus Testing Management System is an online virus diagnostic platform. A cross-site request forgery vulnerability exists in version 1.0 of the PHPGurukul Nipah Virus Testing Management System, which stems from the parameter pid in the file manage-phlebotomist.php that can lead to cross-sit...
CVE-2023-43194
Submitty before v22.06.00 is vulnerable to Incorrect Access Control. An attacker can delete any post in the forum by modifying request parameter...
CVE-2023-38194
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter...
jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()
A flaw was found in the jetty-server package. A servlet with multipart support could get an OutOfMemorryError when the client sends a part that has a name but no filename and substantial content. This flaw allows a malicious user to jeopardize the environment by leaving the JVM in an unreliable...
(0Day) ZTE MF286R goahead Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ZTE MF286R routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of a request parameter provided to the SETDEVICELED endpoint. The...
PrestaShop 路径遍历漏洞
PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution offers multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop tshirtecommerce 2.1.4 and earlier versions, which originates fro...
CVE-2023-2646
A vulnerability has been found in TP-Link Archer C7v2 v2enus180114 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component GET Request Parameter Handler. The manipulation leads to denial of service. The attack can only be done within the local...
CVE-2023-2646 TP-Link Archer C7v2 GET Request Parameter denial of service
A vulnerability has been found in TP-Link Archer C7v2 v2enus180114 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component GET Request Parameter Handler. The manipulation leads to denial of service. The attack can only be done within the local...
CVE-2023-2646 TP-Link Archer C7v2 GET Request Parameter denial of service
A vulnerability has been found in TP-Link Archer C7v2 v2enus180114 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component GET Request Parameter Handler. The manipulation leads to denial of service. The attack can only be done within the local...
SUSE CVE-2008-2370
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. d...