CVE-2022-28770

Due to insufficient input validation, SAPUI5 libraryvbm - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a script into the URL and execute code. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and...

Input validation

Due to insufficient input validation, SAPUI5 libraryvbm - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a script into the URL and execute code. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and...

CVE-2022-24342

In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible...

CVE-2022-24342

In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible...

Design/Logic Flaw

In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible...

CVE-2022-24342

CVE-2022-24342 affects JetBrains TeamCity prior to 2021.2.1, where URL injection could lead to CSRF. Public sources (NVD/NVD-derived entries and Red Hat advisories) confirm the same issue and identify TeamCity as the affected product. The JetBrains Security Bulletin Q4 2021 lists “URL injection l...

CVE-2022-24342

In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible...

CVE-2022-23054

OpenMCT (NASA) versions 1.3.0–1.7.7 are vulnerable to stored XSS via the Summary Widget’s URL field. Root cause: the URL value is not properly escaped/filtered, enabling injection of malicious JavaScript. Impact described: attacker can inject code into the field, with related persistence/impact a...

CVE-2022-23127

Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E 10.95.210.01 and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the...

DEBIAN-CVE-2021-44537

ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution...

CVE-2021-44537

ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution...

SUSE-SU-2021:3556-1 Security update for salt

This update for salt fixes the following issues: - Support querying for JSON data in external sql pillar. - Exclude the full path of a download URL to prevent injection of malicious code. bsc1190265, CVE-2021-21996...

SUSE-SU-2021:3550-1 Security update for Salt

This update fixes the following issues: salt: - Fix the regression of dockercontainer state module - Support querying for JSON data in external sql pillar - Exclude the full path of a download URL to prevent injection of malicious code bsc1190265 CVE-2021-21996 - Fix wrong relative paths resoluti...

GHSA-XGPF-P52J-PF7M XSS in CreateQueuedJobTask

A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL...

[ASA-202102-37] python: multiple issues

Arch Linux Security Advisory ASA-202102-37 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2021-3177 CVE-2021-23336 Package : python Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1465 Summary ======= The package python...

Vulnerability fixed in Webex Meetings and Meetings Server

A vulnerability has been fixed in Cisco Webex Meetings and Cisco Webex Meetings Server. The vulnerability allows an authenticated remote malicious party to add a rogue URL to the username field within a Webex invitation. Cisco has released updates to fix the vulnerability. More information can be...

EMC RSA Archer 6.8 < 6.8.0.4 / 6.9 < 6.9.0.1 URL Injection

The version of EMC RSA Archer running on the remote web server is 6.8.x prior to 6.8.0.4 6.8 P4 or 6.9.x prior to 6.9.0.1 6.9 P1. It is, therefore, affected by a URL injection vulnerability. An unauthenticated, remote attacker can exploit this by tricking a victim application user to execute...

cPanel URL Parameter Injection Vulnerability

cPanel is a set of Web-based host control management system of the U.S. cPanel. A URL parameter injection vulnerability exists in multiple interfaces in versions of cPanel prior to 90.0.17. No detailed vulnerability details are provided at this time...

Dell EMC RSA Archer Injection Vulnerability

Dell EMC RSA Archer is an enterprise IT governance and compliance governance product from Dell USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. An injection vulnerability exists in Dell EMC RSA Archer versions 6.8...

CVE-2020-26884

RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application...