my-site security vulnerabilities

my-site is WinterChenS individual developer's personal website based on springboot2.0 development, integrated: personal home page, personal blog, personal works. my-site has a security vulnerability that originates from an authentication flaw caused by improper handling of the parameter uri in th...

WWBN AVideo Cross-Site Script Vulnerability

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A cross-site scripting vulnerability exists in WWBN AVideo version 14.4, which stems from the userLogin cancelUri parameter could lead to a cross-site scripting attack...

WWBN AVideo Cross-Site Script Vulnerability

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A cross-site scripting vulnerability exists in WWBN AVideo version 14.4, which stems from the LoginWordPress loginForm cancelUri parameter could lead to a cross-site scripting attack...

CVE-2020-15477

The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the childprocess.exec function...

WordPress plugin Smart Custom 404 Error Page – Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

PT-2024-37616

Name of the Vulnerable Software and Affected Versions MESbook version 20221021.03 Description The issue allows a remote, unauthenticated attacker to exploit the endpoint "/api/Proxy/Post?userName=&password=&uri=FILE|INTERNAL URL|IP/HOST" or "/api/Proxy/Get?userName=&password=&uri=ARCHIVO|URL...

CVE-2022-45176

An issue was discovered in LIVEBOX Collaboration vDesk through v018. Stored Cross-site Scripting XSS can occur under the /api/v1/getbodyfile endpoint via the uri parameter. The web application through its vShare functionality section doesn't properly check parameters, sent in HTTP requests as...

PT-2024-11691 · Unknown · Livebox Collaboration Vdesk

Name of the Vulnerable Software and Affected Versions: LIVEBOX Collaboration vDesk versions through v018 Description: An issue in the web application allows Stored Cross-site Scripting XSS to occur under the "/api/v1/getbodyfile" endpoint via the uri parameter. The application does not properly...

CVE-2022-45176: Improper Neutralization of Input During Web Page Generation

An issue was discovered in LIVEBOX Collaboration vDesk through v018. Stored Cross-site Scripting XSS can occur under the /api/v1/getbodyfile endpoint via the uri parameter. The web application through its vShare functionality section doesn't properly check parameters, sent in HTTP requests as...

CVE-2024-0319 Open Redirect vulnerability in FireEye HXTool

Open Redirect vulnerability in FireEye HXTool affecting version 4.6, the exploitation of which could allow an attacker to redirect a legitimate user to a malicious page by changing the 'redirecturi' parameter...

CVE-2023-6380

Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability i...

Open redirect

Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability i...

CVE-2023-6380

CVE-2023-6380 : Open Redirect in Alkacon Software OpenCms. Affected: OpenCms 14–15 with the Mercury template. Root cause: lack of sanitization of the URI parameter enables an attacker to craft a link and lure a user to a malicious site, potentially facilitating phishing or malware distribution. I...

CVE-2023-6380 Open Redirect in Alkacon Software OpenCms

Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability i...

PT-2023-32635 · Opencms · Opencms

Name of the Vulnerable Software and Affected Versions: Open CMS versions 14 through 15 of the 'Mercury' template Description: An open redirect vulnerability has been found in the Open CMS product. This issue allows an attacker to create a specially crafted URL and send it to a specific user,...

CVE-2023-6380: URL Redirection to Untrusted Site

Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability i...

GHSA-86Q5-QCJC-7PV4 Presto JDBC Server-Side Request Forgery by nextUri

Summary Presto JDBC is vulnerable to Server-Side Request Forgery SSRF when connecting a remote Presto server. An attacker can modify the nextUri parameter to internal server in response content that Presto JDBC client will request next and view sensitive information from highly sensitive internal...

PT-2023-29248 · Unknown · Lemonldap::Ng

Name of the Vulnerable Software and Affected Versions: LemonLDAP::NG versions prior to 2.17.1 Description: A Server-Side Request Forgery issue in the OpenID Connect Issuer allows authenticated remote attackers to send GET requests to arbitrary URLs through the request uri authorization parameter...

CVE-2022-37310: Improper Neutralization of Input During Web Page Generation

OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /!!&app=io.ox/files&cap= URI...

Fortinet Fortigate xss (FG-IR-21-222)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-222 advisory. - An improper neutralization of input during web page generation vulnerability CWE-79 in FortiOS version 7.2.0, version 6.4.0...