CVE-2020-14330

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

CVE-2020-13127

A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.04.1 allows remote authenticated attackers to execute arbitrary SQL commands via the TASKSLISTpt.querystring parameter...

PT-2020-13344

Name of the Vulnerable Software and Affected Versions Loway QueueMetrics versions prior to 19.04.1 Description A SQL injection issue exists at the tpf URI, allowing remote authenticated attackers to execute arbitrary SQL commands via the TASKS LIST pt.querystring parameter. Recommendations For...

CVE-2020-13127: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.04.1 allows remote authenticated attackers to execute arbitrary SQL commands via the TASKSLISTpt.querystring parameter...

NEC ExpressCluster ApplyConfig XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster. Authentication is not required to exploit this vulnerability. The specific flaw exists within the clpwebmc executable. Due to the improper restriction of XML External Enti...

minify:minify-data-uri-fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6587409154965504 Project: minify Fuzzing Engine: libFuzzer Fuzz Target: minify-data-uri-fuzzer Job Type: libfuzzerasanminify Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000074d94b4 Crash State: NULL Sanitizer: address ASAN...

Design/Logic Flaw

The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI...

CVE-2020-25120

The CVE-2020-25120 entry affects vBulletin Admin Control Panel in version 5.6.3, where an XSS vulnerability exists in the admincp/search.php?do=dosearch URI. The vulnerability enables cross‑site scripting with a low overall severity (NVD CVSS v2 base score 3.5; CVSS v3.1 base score 4.8) and impac...

CVE-2020-25068

Setelsa Conacwin v3.7.1.2 is vulnerable to a local file inclusion vulnerability. This vulnerability allows a remote unauthenticated attacker to read internal files on the server via an http:IP:PORT/../../path/filetodisclose Directory Traversal URI. NOTE: The manufacturer indicated that the affect...

Exploit for Path Traversal in Setelsa-Security Conacwin

CVE-2020-25068 Python exploit for Conacwin v3.7.1.2. Setelsa...

Ansible: masked keys for uri module are exposed into content and json output

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

URI Blocked Due to Exclusion Rule

Requests to the URI were blocked due to a matching Exclusion rule. No source data...

Mozilla: WebRTC permission prompt could have been bypassed by a compromised content process

When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox 78...

Mozilla: WebRTC permission prompt could have been bypassed by a compromised content process

When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox 78...

CVE-2020-12424

When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox 78...

PT-2020-6774

Name of the Vulnerable Software and Affected Versions LemonLDAP::NG versions through 2.0.8 Lemonldap::NG handler for Node.js versions before 0.5.2 Description An issue in LemonLDAP::NG allows an attacker to bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized...

TeamViewer Unquoted URI Handler SMB Redirect

This module exploits an unquoted parameter call within the Teamviewer URI handler to create an SMB connection to an attacker controlled IP. TeamViewer use auxiliary/server/teamviewerurismbredirect msf auxiliaryteamviewerurismbredirect show actions ...actions... msf auxiliaryteamviewerurismbredire...

CVE-2020-15925

A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.10.21 allows remote authenticated attackers to execute arbitrary SQL commands via the TPFXPAR1 parameter...

PT-2020-14719

Name of the Vulnerable Software and Affected Versions Loway QueueMetrics versions prior to 19.10.21 Description A SQL injection issue exists at a tpf URI, allowing remote authenticated attackers to execute arbitrary SQL commands via the TPF XPAR1 parameter. Recommendations For versions prior to...

CVE-2020-15925: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.10.21 allows remote authenticated attackers to execute arbitrary SQL commands via the TPFXPAR1 parameter...