3791 matches found
CVE-2020-35930: Improper Neutralization of Input During Web Page Generation
Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI...
CVE-2020-35743: Improper Neutralization of Special Elements used in an SQL Command
HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages...
CVE-2020-35742: Improper Neutralization of Special Elements used in an SQL Command
HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter...
Cxuucms 跨站脚本漏洞
CxuuCms is an easy-to-use, open source PHP+Mysql based content management system. CXUUCMS 3.1 suffers from a reflective cross-site scripting vulnerability. Attackers can use the vulnerability to inject arbitrary Web script or HTML via the imgurl parameter of admin.php?c=content&a=add...
CVE-2020-35589
The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed b...
CVE-2020-26836
SAP Solution Manager Trace Analysis, version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the...
CVE-2020-26836: URL Redirection to Untrusted Site
SAP Solution Manager Trace Analysis, version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the...
CVE-2020-29135
cPanel before 90.0.17 has multiple instances of URL parameter injection SEC-567...
Code injection
cPanel before 90.0.17 has multiple instances of URL parameter injection SEC-567...
CVE-2020-29135
CVE-2020-29135 affects cPanel prior to 90.0.17, with multiple instances of URL parameter injection (SEC-567). The connected records identify the affected product and the vulnerability type, but do not provide explicit exploitation details, affected components beyond the web interfaces, or a confi...
PT-2020-17095
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 90.0.17 Description The issue concerns multiple instances of URL parameter injection. Recommendations For versions prior to 90.0.17, update to version 90.0.17 or later to resolve the issue...
CVE-2020-29135: Inappropriate Encoding for Output Context
cPanel before 90.0.17 has multiple instances of URL parameter injection SEC-567...
cPanel 注入漏洞
cPanel is a set of Web-based host control management system of the U.S. cPanel. A URL parameter injection vulnerability exists in multiple interfaces in versions of cPanel prior to 90.0.17. No detailed vulnerability details are provided at this time...
CVE-2020-5651
SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary SQL commands via a specially crafted URL...
PT-2020-16565 · Emby · Emby Server
Name of the Vulnerable Software and Affected Versions: Emby Server versions prior to 4.5.0 Description: The issue allows for Server-Side Request Forgery SSRF via the ImageURL parameter in the Items/RemoteSearch/Image endpoint. This means an attacker could potentially force the server to make...
CVE-2020-7741 Cross-site Scripting (XSS)
This affects the package hellojs before 1.18.6. The code get the param oauthredirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauthredirect, such as javascript:alert1...
Cross-site Scripting (XSS)
Overview hellojs is a Javascript RESTFUL API library for connecting with OAuth2 services. Affected versions of this package are vulnerable to Cross-site Scripting XSS. The code gets the param oauthredirect from url and passes it to location.assign without any sanitisation. So an attack can pass j...
CVE-2020-5975
NVIDIA GeForce NOW, versions prior to 2.0.23 on Windows and macOS, contains a vulnerability in the desktop application software that includes sensitive information as part of a URL, which may lead to information disclosure...
The vulnerability of the Cisco Webex Meetings Desktop App’s software lies in errors during URL parameter verification, allowing attackers to re-record arbitrary files.
The vulnerability of the Cisco Webex Meetings Desktop App’s software relates to errors during the validation of URL parameters. Exploiting this vulnerability allows a malicious actor to re-record any files at will...