ALPINE-CVE-2019-18348

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the host component of a URL follow...

CVE-2019-18348

Removed by vendor...

CVE-2019-18348

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the host component of a URL follow...

CVE-2019-18348: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the host component of a URL follow...

Cross site scripting

In FusionPBX up to v4.5.7, the file app\conferencesactive\conferenceinteractive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16970: Improper Neutralization of Input During Web Page Generation

In FusionPBX up to 4.5.7, the file app\sipstatus\sipstatus.php uses an unsanitized "savemsg" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2016-11015

NETGEAR JNR1010 devices prior to firmware 1.0.0.32 are affected by a CSRF vulnerability in the web UI: cgi-bin/webproc can be invoked via the parameter :InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL. The issue enables cross-site request forgery. Remediation: upgrade to firmware vers...

Command injection

An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url parameter...

CVE-2019-9741

An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command...

CVE-2015-9467

The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter...

CVE-2019-11527: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url parameter...

CVE-2015-9467: Improper Neutralization of Special Elements used in an SQL Command

The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter...

PT-2019-7426

Name of the Vulnerable Software and Affected Versions broken-link-manager plugin versions prior to 0.5.0 Description The issue concerns SQL injection via the url parameter in the wpslDelURL or wpslEditURL functions. This allows for potential SQL injection attacks. Recommendations For versions pri...

PT-2019-12356

Name of the Vulnerable Software and Affected Versions Softing uaGate SI version 1.60.01 Description An issue was discovered in the software, where a CGI script is vulnerable to command injection with a maliciously crafted url parameter. Recommendations For version 1.60.01, consider restricting...

CVE-2019-15810

Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter...

CVE-2019-15810

Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter...

CVE-2019-15810

The CVE-2019-15810 entry concerns Netdisco 2.042010, where insufficient sanitization during the device search allows a reflected XSS via manipulation of a URL parameter. The root cause is inadequate input sanitization in the search path; the impact is a reflected cross-site scripting vulnerabilit...

CVE-2019-15810

Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter...

CVE-2019-15810

Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter...

CVE-2019-15810: Improper Neutralization of Input During Web Page Generation

Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter...