3785 matches found
CVE-2022-47065
CVE-2022-47065 : A stack overflow exists in TrendNet Wireless AC Easy-Upgrader TEW-820AP (v1.0R, firmware 1.01.B01) triggered by the submit-url parameter at the /formNewSchedule endpoint. The vulnerability allows arbitrary code execution and is noted to affect products no longer supported by the ...
Open Redirect
symbiote/silverstripe-seed is vulnerable to open redirect. The vulnerability exists due to insufficient checks for URL parameter SecurityLoginExtension.php file, which allows an attacker to redirect the user to an arbitrary website via a crafted URL...
Jettweb Ready Rent A Car Script 4 Cross Site Scripting
┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...
Academy LMS 5.11 Cross Site Scripting
┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...
CVE-2023-0023: Exposure of Sensitive Information to an Unauthorized Actor
In SAP Bank Account Management Manage Banks application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. They might get captured in log files, bookmarks, and so on disclosing sensitive data of the application...
Inline SVG vulnerable to Cross-site Scripting
A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inlinesvg/actionview/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to...
GHSA-P33Q-4H4M-J994 Inline SVG vulnerable to Cross-site Scripting
A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inlinesvg/actionview/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to...
CVE-2020-36644
A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inlinesvg/actionview/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to...
CVE-2020-36644
A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inlinesvg/actionview/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to...
CVE-2020-36644 jamesmartin Inline SVG URL Parameter helpers.rb cross site scripting
A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inlinesvg/actionview/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to...
CVE-2020-36644
Inline SVG by jamesmartin is affected up to version 1.7.1. The vulnerability resides in the URL Parameter Handler, specifically lib/inline_svg/action_view/helpers.rb, where manipulating the filename argument can trigger cross-site scripting. It can be exploited remotely. Upgrading to version 1.7....
CVE-2020-36644: Improper Neutralization of Input During Web Page Generation
A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inlinesvg/actionview/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to...
Inline SVG vulnerable to Cross-site Scripting
A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inlinesvg/actionview/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to...
Axiell Iguana CMS 跨站脚本漏洞
Axiell Iguana CMS is a control-based platform from Axiell Inc. for personalizing and communicating with customers. Axiell Iguana CMS has a security vulnerability that originates from a wrong url parameter on noverist.php, which can be exploited by an attacker to execute code in the victim's brows...
CVE-2022-45052: Files or Directories Accessible to External Parties
A Local File Inclusion vulnerability has been found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter on the Proxy.type.php endpoint, external users are capable of accessing files on the server...
CVE-2022-45049: Improper Neutralization of Input During Web Page Generation
A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The url parameter on the novelist.php endpoint does not properly neutralise user input, resulting in the vulnerability...
CVE-2022-39039
The CVE-2022-39039 issue affects aEnrich’s a+HRD . It is caused by inadequate filtering of a specific URL parameter, allowing an unauthenticated remote attacker to perform a Server-Side Request Forgery (SSRF) by sending arbitrary HTTP(S) requests. The vulnerability can lead to the execution of ar...
CVE-2022-39039 aEnrich a+HRD - Server-Side Request Forgery (SSRF)
aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to send arbitrary HTTPs request to launch Server-Side Request Forgery SSRF attack, to perform arbitrary system command or disrupt service...
PT-2023-13671 · A+Hrd · A+Hrd
Name of the Vulnerable Software and Affected Versions: a+HRD affected versions not specified Description: The issue is related to inadequate filtering for a specific URL parameter in a+HRD, allowing an unauthenticated remote attacker to exploit this and send arbitrary HTTPs requests. This can lea...