CVE-2017-3799

CVE-2017-3799 concerns a URL-parameter open-redirect vulnerability in Cisco WebEx (WebEx Meeting Center). The Cisco advisory attributes the issue to insufficient input validation, where an attacker could craft a link containing a remote site URL in the affected parameter to redirect users to a ma...

DEBIAN-CVE-2016-7999

ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery SSRF attacks via a URL in the varurl parameter in a validerxml action...

CVE-2016-7169

Directory traversal vulnerability in the FileUploadUpgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter...

CVE-2016-7169

Directory traversal vulnerability in the FileUploadUpgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter...

Directory traversal

Directory traversal vulnerability in the FileUploadUpgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter...

useragentstring.com XSS vulnerability

Vulnerable URL: http://www.useragentstring.com/pages/useragentstring.php?name=Chrome" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 90086 VIP website status:| No Check...

feriaok.com.bo XSS vulnerability

Vulnerable URL: http://www.feriaok.com.bo/clasificados?q=%3C/script%3E%3Cimg%20src=x%20onerror=prompt/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1082684 VIP websit...

CVE-2016-1000229

It was found that swagger-ui contains a cross site scripting XSS vulnerability in the key names in the JSON document. An attacker could use this flaw to supply a key name with script tags which could cause arbitrary code execution. Additionally it is possible to load the arbitrary JSON files...

Trend Micro Control Manager task_controller Information Disclosure

An information disclosure vulnerability has been reported in Trend Micro Control Manager. The vulnerability is due to lack of validation of the 'url' parameter in the request for taskcontrol.php. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted HT...

SQL Injection Vulnerability in the groupUrl Parameter of getGroupedProjectTemplate on the Internet User Speed Measurement Platform of Freescale Technology (Beijing) Co.

FeiShiDa Technology Beijing Co., Ltd. Internet user speed test platform is used to provide users with mobile broadband online test WEB system. The product has a SQL injection vulnerability, the vulnerability URL is: http://target/getGroupedProjectTemplate?groupUrl=, the injection parameter is:...

SQL Injection Vulnerability in Fuzhou Tranda Special Equipment Safety Monitoring System

Fuzhou Chuangda special equipment safety monitoring system using B / S structure, the use of J2EE for development, the system can run on any operating system platform, running into the server and client operation, the server runs the corresponding WEB APPLICATION services such as: TOMCAT, JBOSS,...

Khan Academy: OPEN URL REDIRECT through PNG files

An abuse of the imageurl parameter when saving a CS program was able to create an arbitrary external redirect. We now validate the parameter before using it. I have found a way through which an attacker can use png files to redirect to malicious domain...

rentcar.alkhouzama.ma XSS vulnerability

Vulnerable URL: http://rentcar.alkhouzama.ma/index.php?lang=zh-CN"...

Trend Micro Control Manager task_controller Information Disclosure Vulnerability

This vulnerability allows remote attackers to leak sensitive information on vulnerable installations of Trend Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within taskcontroller.php. The url parameter does not properly sanitize the...

Cross-Site Scripting

Overview Affected versions of swagger-ui are vulnerable to cross-site scripting via the url query string parameter. Recommendation Update to 2.2.1 or later. References - GitHub Issue - GitHub Advisory...

Cross-Site Scripting

Overview Affected versions of swagger-ui contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document. Proof of Concept The vulnerable object structure is: "definitions": "arbitraryVal": "properties": "": "LoremIpsum" Malicious JSON documents can ...

Bumble: Change contents of the careers iframe in https://corp.badoo.com/jobs

Hi again badoo team , In https://corp.badoo.com/jobs/?p= if you check the page you'll see an iframe from https://jobs.jobvite.com/badoo/ , the p parameter is used to control the iframe link for example if you added https://corp.badoo.com/jobs/?p=somepath the iframe link will be...

edmc.edu XSS vulnerability

Vulnerable URL: http://www.edmc.edu/?SuccessListClientState=...

WebSummit: Time Based SQL injection in url parameter

There is possibility of inducing some time delay in the "url" parameter of the videos.websummit.com using the Benchmark and SQL queries, which could result in timeout for application upon huge delay induced into the application...

CVE-2015-7360

Multiple cross-site scripting XSS vulnerabilities in the Web User Interface WebUI in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 serial parameter to alerts/summary/profile/; the 2 urlForCreatingReport parameter to csearch/report/export/...