CVE-2020-13802

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification...

CVE-2020-13802

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification...

Command injection

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification...

CVE-2020-13802

CVE-2020-13802 affects Rebar3 versions 3.0.0-beta.3 to 3.13.2, exposing OS command injection via a URL parameter in dependency specifications. The vulnerability is described across multiple sources (NVD, Gentoo GLSA, Mageia, Nessus, OpenVAS, Exploit-DB) with CVSS v3.1 base score 9.8 (CRITICAL). E...

CVE-2020-13802

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification...

CVE-2020-13802

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification...

CVE-2020-13802: Improper Neutralization of Special Elements used in an OS Command

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification...

PT-2020-13686

Name of the Vulnerable Software and Affected Versions Rebar3 versions 3.0.0-beta.3 through 3.13.2 Description The issue concerns OS command injection via the URL parameter of dependency specification. Recommendations For versions 3.0.0-beta.3 through 3.13.2, update to a version that contains a fi...

PT-2020-7934

Name of the Vulnerable Software and Affected Versions: swagger-ui versions prior to 2.2.1 Description: The issue concerns cross-site scripting in the consumes and produces parameters of the swagger JSON document for a given API. Additionally, swagger-ui allows users to load arbitrary swagger JSON...

CVE-2020-24898

The Table Filter and Charts for Confluence Server app before 5.3.26 for Atlassian Confluence allows SSRF via the "Table from CSV" macro URL parameter...

CVE-2020-24898

The Table Filter and Charts for Confluence Server app before 5.3.26 for Atlassian Confluence allows SSRF via the "Table from CSV" macro URL parameter...

CVE-2020-24898

The Table Filter and Charts for Confluence Server app before 5.3.26 for Atlassian Confluence allows SSRF via the "Table from CSV" macro URL parameter...

PT-2020-15853

Name of the Vulnerable Software and Affected Versions Table Filter and Charts for Confluence Server versions prior to 5.3.26 Description The issue allows for Server-Side Request Forgery SSRF via the "Table from CSV" macro, specifically through a URL parameter. Recommendations For versions prior t...

CVE-2020-24898: Server-Side Request Forgery (SSRF)

The Table Filter and Charts for Confluence Server app before 5.3.26 for Atlassian Confluence allows SSRF via the "Table from CSV" macro URL parameter...

Dropcontact: Unauthorized Access and updation of EMAIL settings of other user at https://app.dropcontact.io/app/sponsorship/ by changing the " email " parameter.

When changing email settings with firstpromoter, the email of the account was right in the url, so by changing this parameter, we could change setting of other users...

CRLF Injection

urllib2 in python2 is vulnerable to CRLF injection. The vulnerability exists if an attacker controls a URL parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the host component of a URL followed by an HTTP header. This vulnerability is similar to...

Code injection

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the rd parameter can accept a URL, to which users will be redirected after a successful login. In conjunction with CVE-2019-12784, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site,...

Design/Logic Flaw

Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php?action=attachUrlPreview url parameter, if the destination URL hosts an HTML document containing 'meta name="og:image" content="' followed by an intranet URL...

PT-2020-13567

Name of the Vulnerable Software and Affected Versions Bitrix24 versions prior to 20.0.976 Description The issue allows for Server-Side Request Forgery SSRF via an intranet IP address in the "services/main/ajax.php?action=attachUrlPreview" API endpoint, specifically through the url parameter. This...

Cross-Site Scripting (XSS)

portal-service is vulnerable to cross-site scripting XSS. The library does not sanitize the URL parameter in simplecaptcha.jsp, allowing an attacker to inject arbitrary script via the affected parameter...