tomcat RequestDispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. d...

Citrix Access Gateway information leak

HTTP session cookie is passed through HTTP GET request parameters, making it possible to leak it value thorugh Referer: field or in the browsing history...

CVE-2007-1605

w-Agora Web-Agora allows remote attackers to obtain sensitive information via a request to rss.php with an invalid 1 site or 2 bn parameter, 3 a certain value of the site parameter, or 4 an empty value of the bn parameter; a request to index.php with a certain value of the 5 site or 6 sort...

LoveCMS 1.4 - step Traversal Arbitrary File Access

LoveCMS 1.4 - step Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issu...

DLink 514 DHCP crossite scripting

Crossite scripting via DHCP request parameters...

Переполнение буфера в DNewsweb

Некоторый параметры запроса QUERYSTRING, например group и utag могут быть переполнены, таким образом может быть выполнен код в контексте сервера...

CVE-2020-15146: Remote Code Execution in OptionsParser while using request parameters inside expression language

Impact Request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. The vulnerable versions...