CVE-2017-16664

Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System OTRS 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation...

justice.gov Open Redirect vulnerability

Open Bug Bounty ID: OBB-424104 Description| Value ---|--- Affected Website:| justice.gov Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet Vulnerable...

Design/Logic Flaw

VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add a malicious URL to an enrolled device's 'Links' page. Successful exploitation of this issue could result in an unsuspecting AWC user being redirected to a malicious URL...

AlienVault : DNS pinning SSRF

Hello there, this is for the otx.alienvault.com domain, but I couldn't mark it in the drop down menu. I saw the note about the 2 weeks so I decide to report this. Summary: I've found that you can perform a SSRF attackwith DNS pinning and read the response from url http://169.254.169.254 Browsers...

Catalyst Mahara Unauthorized Operation Vulnerability (CNVD-2017-36221)

Catalyst Mahara is a social networking system from Catalyst IT in New Zealand. The system includes a blog, resume builder, file manager, and more. A security vulnerability exists in Catalyst Mahara. An attacker can exploit the vulnerability by manipulating the URL to delete submitted pages...

CVE-2017-1000142

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to users being able to delete their submitted page through URL manipulation...

CVE-2017-1000142

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to users being able to delete their submitted page through URL manipulation...

Information disclosure

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to users being able to delete their submitted page through URL manipulation...

CVE-2017-1000142

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to users being able to delete their submitted page through URL manipulation...

CVE-2017-1000142

The CVE affects Mahara releases prior to 1.8.7, 1.9.5, 1.10.3 and 15.04.0 (i.e., Mahara 1.8, 1.9, 1.10 series and 15.04) where users could delete their submitted pages via URL manipulation. The root cause is not explicitly detailed in the provided documents beyond this behavior. The references co...

PT-2025-32250

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 139.0.7258.66 Description A lack of proper validation of untrusted input within the Core component of Google Chrome permitted a remote attacker to manipulate the Omnibox URL bar display through a specially craft...

Open redirect

In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to append a combination of characters to the URL that will allow for an open redirect. An attacker could exploit this as a phishing attack to gain...

Directory Traversal

360class.jansenhm is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url./n...

Open redirect

Multiple open redirect vulnerabilities in OpenText Documentum Webtop 6.8.0160.0073 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a 1 URL in the startat parameter to xda/help/en/default.htm or 2 /%09/ slash encoded horizontal tab slash followed by...

finearts.uvic.ca XSS vulnerability

Vulnerable URL: https://finearts.uvic.ca/theatre/phoenix/season/2008-2009/Darkmoon/svcore/full.html?bg=xss"=https%3A%2F%2Ffinearts.uvic.ca%2Ftheatre%2Falumni%2Fprofiles%2Fdesigners%2FPatrickDuWors%2Fgallery.xml=false=true=false=true=true=false=%23fff=%23fff=true=-1 Details: Description| Value...

CVE-2015-3198

The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL...

X (Formerly Twitter): Open Redirect

Hello, i found Open Redirect POC : - go to...

CVE-2017-5943

CVE-2017-5943 affects Request Tracker (RT) 4.x series. A remote attacker can obtain CSRF verification tokens by sending a crafted URL, enabling leakage of token data. Affected versions include RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2. CVSS appears high (8.8) with network ...

microlab.uwyo.edu XSS vulnerability

Vulnerable URL: http://microlab.uwyo.edu/Labs/labpage.asp?LabCombo=1"...

Radancy: Open redirect on https://werkenbijdefensie.nl/

Domain and URL: https://werkenbijdefensie.nl/ajax/contrast.php?contrast=1 Description: By adding "?contrast=1" after every url, it wil be redirect to the path after https://werkenbijdefensie.nl/ So I can redirect it to another website by adding one more slash F196351 Browsers Verified In: Any...