The vulnerability of the Tenda AC15 AC1900 router’s microprogramming software lies in the insufficient neutralization of special elements transmitted in URIs, allowing a hacker to execute arbitrary commands on the target system.

The vulnerability of the Tenda AC15 AC1900 router’s microprogramming software is related to the insufficient neutralization of special elements transmitted in URIs. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the target system by sending specially craft...

PT-2020-6898

Name of the Vulnerable Software and Affected Versions Apache HttpClient versions prior to 4.5.13 and 5.0.3 Description The issue is related to the insufficient validation of input data in Apache HttpClient, which can lead to misinterpretation of malformed authority components in request URIs. Thi...

PYSEC-2020-3

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

CVE-2020-25124

The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI...

undertow: Client can use bogus uri in Digest authentication

It was discovered that when using Digest authentication, the server does not ensure that the value of the URI in the authorization header matches the URI in the HTTP request line. This allows the attacker to execute a MITM attack and access the desired content on the server...

CVE-2020-6245

SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers...

envoy: crafted request with long URI allows remote attacker to cause denial of service

A flaw was found in Envoy through version 1.11.1. Users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service through memory consumption. The highest thre...

CVE-2020-11628

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. It is intended to support restriction of available remote protocols CMP, ACME, REST, etc. through the system configuration. These restrictions can be bypassed by modifying the URI string from a client. EJBCA's internal acces...

Unspecified Vulnerability in PrimeKey Solutions EJBCA

PrimeKey Solutions EJBCA is a software PKI certificate authority package from PrimeKey Solutions, Sweden. A security vulnerability exists in PrimeKey Solutions EJBCA versions prior to 6.15.2.6 and 7.x versions prior to 7.3.1.2. An attacker can exploit this vulnerability to bypass security...

Chadha Software Technologies PHPKB Standard Multi-Language Cross-Site Scripting Vulnerability (CNVD-2020-18654)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A cross-site scripting vulnerability exists in the way URIs are handled in the admin/header.php file in Chadha Software Technologies...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-17366)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflected cross-site scripting vulnerability exists in admin/manage-users.php in Chadha PHPKB Standard Multi-Language version 9. T...

Chadha PHPKB cross-site scripting vulnerability (CNVD-2020-17367)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflected cross-site scripting vulnerability exists in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language version 9...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-17355)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflected cross-site scripting vulnerability exists in admin/index.php in Chadha PHPKB Standard Multi-Language version 9. The...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-17206)

Chadha PHPKB is a knowledge base software that keeps information organized, accessible and manageable for internal teams and external clients. A reflected cross-site scripting vulnerability exists in admin/add-glossary.php in Chadha PHPKB Standard Multilingual Version 9. The vulnerability stems...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-17217)

Chadha PHPKB is a knowledge base software that keeps information organized, accessible and manageable for internal teams and external clients. A reflected cross-site scripting vulnerability exists in admin/import-csv.php in Chadha PHPKB Standard Multilingual Version 9. The vulnerability stems fro...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-17216)

Chadha PHPKB is a knowledge base software that keeps information organized, accessible and manageable for internal teams and external clients. A reflected cross-site scripting vulnerability exists in admin/import-html.php in Chadha PHPKB Standard Multilingual Version 9. The vulnerability stems fr...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-17939)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflected cross-site scripting vulnerability exists in admin/my-profile.php in Chadha PHPKB Standard Multi-Language 9. The...

CVE-2020-10441

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-article-monthly.php by adding a question mark ? followed by the payload...

CVE-2020-10421

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-departments.php by adding a question mark ? followed by the payload...

PT-2020-12101 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns the handling of URIs in admin/header.php, which allows for Reflected XSS attacks. This can be exploited by injecting arbitrary web script or HTML in...