CVE-2020-26884

RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application...

Design/Logic Flaw

RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application...

CVE-2020-26884

CVE-2020-26884 affects RSA Archer 6.8 (6.8.0.0–6.8.0.3) and 6.9, with a URL injection vulnerability allowing an unauthenticated, remote attacker to trick a victim user into executing malicious JavaScript in the web application. The connected documents confirm the affected versions and the injecti...

CVE-2020-26884

RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application...

CVE-2020-27627

JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection...

Design/Logic Flaw

JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection...

CVE-2020-27627

JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection...

CVE-2020-27627

JetBrains TeamCity prior to 2020.1.2 is described as vulnerable to URL injection (CVE-2020-27627). The connected Red Hat, CNVD, NVD, and CVE listings reiterate that versions before 2020.1.2 are affected, but do not provide technical details about the vulnerability’s root cause, affected component...

Status.im: HTTP Parameter Pollution with semicolons in iframe allows loading external Greenhouse forms

Summary: Status.im uses Greenhouse for job applications, specifically the older Greenhouse integration which relies on iframes. The ghjid URL parameter is used to load the correct form in the iframe. HTML characters are escaped, but using semicolons you can inject URL parameters into the iframe v...

Security Policy Bypass

firefox:bionic is vulnerable to security policy bypass. By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security Policy CSP...

Cross-Site Scripting in yui

Affected versions of yui are vulnerable to cross-site scripting in the uploader.swf and io.swf utilities, via script injection in the url. Recommendation YUI has published their recommendation to fix this issue. Their recommendation is to: - Delete self-hosted copies of these files if you are not...

EMC RSA Archer < 6.5.0.7, < 6.6.0.6 and < 6.7.0.1 Multiple Vulnerabilities

The version of EMC RSA Archer running on the remote web server is prior to 6.7.0.3 6.7 P3 or 6.6 P6 6.6.0.6. It is, therefore, affected by multiple vulnerabilities: - RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL injection vulnerability. An unauthenticated remote attacker could...

UBUNTU-CVE-2020-15693

In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call such as httpClient.get or httpClient.post, the User-Agent header value, or custom HTTP header names or value...

CVE-2019-17339

The CVE-2019-17339 issue affects TIBCO Silver Fabric, specifically the VirtualRouter component, with an XSS-like vulnerability that could let an attacker inject scripts via URLs submitted by an authenticated user. Affected releases are Silver Fabric 6.0.0 and earlier. The vulnerability’s impact i...

CVE-2020-10715

A content spoofing vulnerability was found in the openshift/console. This flaw allows an attacker to craft a URL and inject arbitrary text onto the error page that appears to be from the OpenShift instance. This attack could potentially convince a user that the inserted text is legitimate...

Nagios Core < 4.4.6 Multiple Vulnerabilities

Nagios Core is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nagios:nagios"; ifdescription...

Code injection

All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. package.json...

CVE-2020-5336

RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious JavaScript code on the affected system...

CVE-2020-5336

RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious JavaScript code on the affected system...

Design/Logic Flaw

RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious JavaScript code on the affected system...