CVE-2020-4226

IBM MobileFirst Platform Foundation 8.0.0.0 is affected by CVE-2020-4226 due to storing highly sensitive information in URL parameters, enabling potential information disclosure if URLs are exposed via server logs, referrer headers, or browser history. Root cause: sensitive data appended to URLs ...

CVE-2020-12608

An issue was discovered in SolarWinds MSP PME Patch Management Engine Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config. This can lead to code execution by changing the...

CVE-2020-6213

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXTPHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to reflected Cross-Site Scripting XSS via different URL parameters as it does not sufficiently encode user controlled inputs...

Sql injection

HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands...

CVE-2020-10512 HGiga C&Cmail - SQL Injection

HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands...

CVE-2020-10512: Improper Neutralization of Special Elements used in an SQL Command

HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands...

Glassdoor: Reflected XSS on https://www.glassdoor.com/employers/sem-dual-lp/

Summary: There is a reflected XSS on https://www.glassdoor.com/employers/sem-dual-lp/ through the utmsource parameter. By using URL encoding I was able to bypass the WAF. Affected URL or select Asset from In-Scope: https://www.glassdoor.com/ Affected Parameter: utmsource Vulnerability Type: XSS...

python: CRLF injection via the query part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the query string after a ? charact...

Remote Code Execution (RCE)

op-browser is vulnerable to remote code execution RCE. The attack exist because it does not validate the user-provided value to url parameter, allowing an attacker to inject arbitrary code through it...

Myndr: Open Redirect filter bypass through '\' character via URL parameter

Hi, I hope I find you all safe and good regarding those hard times nowadays. Summary: Found an Open Redirect vulnerability on http://meta.myndr.net by bypassing the trusted domain filter using a '' character. I was able to get the original redirection URL from the register button located at...

PT-2020-19333

Name of the Vulnerable Software and Affected Versions VISAM VBASE Editor version 11.5.0.2 VISAM VBASE Web-Remote Module Description The issue allows input passed in the URL that is not properly verified before use, which may allow an attacker to read arbitrary files from local resources...

Sql injection

LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation...

CVE-2020-3922 ArmorX LisoMail - SQL Injection

LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation...

CVE-2020-3922

CVE-2020-3922 affects LisoMail by ArmorX. The vulnerability is an SQL injection via a URL parameter manipulation that allows attackers to access the database without authentication. According to the supplied data, CVSS vectors indicate a NETWORK attack with HIGH/CRITICAL impact (CVSS v3.1: 9.8; c...

PT-2020-17798

Name of the Vulnerable Software and Affected Versions LisoMail, by ArmorX affected versions not specified Description The issue allows SQL Injections, enabling attackers to access the database without authentication by manipulating a URL parameter. Recommendations At the moment, there is no...

CVE-2020-3922: Improper Neutralization of Special Elements used in an SQL Command

LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18329)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9. The...

YzmCMS 'url' Cross-Site Scripting Vulnerability

YzmCMS is a lightweight open source content management system based on PHP + Mysql architecture,YzmCMS can run on Linux, Windows, MacOSX, Solaris and other platforms. YzmCMS 'url' cross-site scripting vulnerability. The vulnerability is due to the application/link/controller/link.class.php file...

YzmCMS 5.5 - (url) Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: YzmCMS 5.5 - 'url' Persistent Cross-Site Scripting Exploit Author: En Vendor Homepage: https://github.com/yzmcms/yzmcms Software Link: https://github.com/yzmcms/yzmcms Version: V5.5 Category: Web Application Patched Version:...

CVE-2020-10212

upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DNS hostname to resolve to an internal IP address. For example, an SSRF attempt may succeed if a .ico filename is added to the...