Path traversal

Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete...

CVE-2022-39033

CVE-2022-39033 affects Smart eVision’s file acquisition function. The root cause is insufficient filtering of special characters in the URL parameter, enabling a path traversal vulnerability. An unauthenticated attacker can bypass authentication and access restricted paths to download and delete ...

CVE-2022-28977

HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users t...

CVE-2022-38931

A Server-Side Request Forgery SSRF in fetchnetfileupload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter...

CVE-2022-38931: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in fetchnetfileupload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter...

PT-2022-6098 · Pdfkit · Pdfkit

Name of the Vulnerable Software and Affected Versions: pdfkit versions 0.0.0 through 0.8.7.2 Description: The issue is related to insufficient argument checking in the pdfkit library, which can be exploited by a remote attacker to execute arbitrary commands. This is a Command Injection...

JGraph draw.io 安全漏洞

JGraph draw.io is a configurable chart/whiteboard visualization application from JGraph. A security vulnerability exists in JGraph draw.io versions prior to 20.2.8, which stems from the proxy url parameter not being rate-limited...

CVE-2022-33149

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugi...

CVE-2022-33149

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugi...

PT-2022-21711

Name of the Vulnerable Software and Affected Versions WWBN AVideo version 11.6 WWBN AVideo dev master commit 3f7c0364 Description A sql injection vulnerability exists in the ObjectYPT functionality, allowing an attacker to inject SQL by manipulating the url parameter. This issue is present in the...

CVE-2022-33149: Improper Neutralization of Special Elements used in an SQL Command

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugi...

CVE-2022-38357

Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /module/moduleframe/index.php...

PT-2022-24385 · Unknown · Eyes Of Network Web Application

Name of the Vulnerable Software and Affected Versions: Eyes of Network Web application affected versions not specified Description: The issue is related to the improper neutralization of special elements, making the Eyes of Network Web application susceptible to an iFrame injection attack. This...

CVE-2022-38357: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /module/moduleframe/index.php...

Eyes of Network Web 注入漏洞

Eyes of Network Web is a global regulatory solution for hardware status of devices, operating systems, standard applications, business applications, and performance from the Eyes of Network Web community. A security vulnerability exists in Eyes of Network Web version 5.3 that originates in the ur...

CVE-2022-1561

The CVE-2022-1561 issue concerns Lura and KrakenD-CE before 2.0.2 and KrakenD-EE before 2.0.0 where URL parameters aren’t sanitized, enabling a crafted URL to alter the backend URL defined for a pipe. The vulnerability does not affect KrakenD itself, but the consumed backend may be vulnerable. Re...

CVE-2022-1561

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, bu...

CVE-2022-32457

Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...

CVE-2022-32457

Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...

Server side request forgery (ssrf)

Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...