10476 matches found
CVE-2020-0696
A security feature bypass vulnerability exists in Microsoft Outlook software when it improperly handles the parsing of URI formats, aka 'Microsoft Outlook Security Feature Bypass Vulnerability'...
CVE-2020-20093
The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages...
CVE-2020-20096
Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages...
CVE-2020-1905
Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have allowed a malicious third party app chosen to open the file to guess the URIs for previously opened attachments until the opener app is...
CVE-2020-5514
Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI...
CVE-2020-10411
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/email-harvester.php by adding a question mark ? followed by the payload...
CVE-2020-11628
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. It is intended to support restriction of available remote protocols CMP, ACME, REST, etc. through the system configuration. These restrictions can be bypassed by modifying the URI string from a client. EJBCA's internal acces...
CVE-2020-10420
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-comments.php by adding a question mark ? followed by the payload...
CVE-2014-9302
Server-side request forgery SSRF vulnerability in the cmisbrowser servlet in Content Management Interoperability Service CMIS in Alfresco Community Edition 5.0.a and earlier allows remote attackers to trigger outbound requests via a crafted URI in the url parameter...
CVE-2014-9301
Server-side request forgery SSRF vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbitrary files via a crafted URI in the endpoint parameter...
CVE-2018-13010
WSTMall v1.9.1170316 has CSRF via the index.php?m=Admin=Users=edit URI to add a user account...
CVE-2019-13475
In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software, one can simply inject -exec to execute...
CVE-2019-17214
The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending =1 to a URI...
CVE-2017-7992
Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter...
CVE-2019-9673
Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI...
CVE-2019-8954
In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter in conjunction with the id parameter in a updjxcode=true action to the ndxzstudio/?a=system URI...
CVE-2018-7741
Eramba e1.0.6.033 has Reflected XSS in the Date Filter via the created parameter to the /crons URI...
CVE-2019-14392
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching SEC-501...