CVE-2019-11776: Improper Neutralization of Input During Web Page Generation

In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context...

PT-2019-12493

Name of the Vulnerable Software and Affected Versions Eclipse BIRT versions 1.0 through 4.7 Description The issue allows Reflected XSS in a URL parameter. An attacker can execute a payload in the victim's browser context. Recommendations For Eclipse BIRT versions 1.0 through 4.7, consider disabli...

CVE-2019-1954

A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to...

CVE-2019-12994: Server-Side Request Forgery (SSRF)

Server Side Request Forgery SSRF exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL...

CVE-2019-12959: Server-Side Request Forgery (SSRF)

Server Side Request Forgery SSRF exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter...

PT-2019-13075

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine AssetExplorer version 6.2.0 Description A Server Side Request Forgery SSRF issue exists, allowing exploitation via a parameter in a URL for the AJaxServlet servlet. Recommendations For Zoho ManageEngine AssetExplorer version...

PT-2019-13052

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine AssetExplorer versions 6.2.0 and earlier Description A Server Side Request Forgery SSRF issue exists in the ClientUtilServlet servlet. This is due to a URL in a parameter that can be manipulated. Recommendations For versions...

Open-School 3.0 Community Edition 2.3 - Cross-Site Scripting

Open-School 3.0 Community Edition 2.3 - Cross-Site Scripting Exploit Title: title Date: 2019 08 06 Exploit Author: Greg.Priest Vendor Homepage: https://open-school.org/ Software Link: Version: Open-School 3.0/Community Edition 2.3 Tested on: Windows/Linux CVE : CVE-2019-14696 Open-School 3.0, and...

CVE-2019-13561

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the onlinefirmwarecheck.cgi checkfwurl parameter...

Code injection

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker is able to sign and encrypt arbitrary messages with Mailvelope, assuming the private key password is cached. A second vulnerability allows ...

CVE-2019-9149

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker is able to sign and encrypt arbitrary messages with Mailvelope, assuming the private key password is cached. A second vulnerability allows ...

CVE-2019-13337

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter accesstoken this is the parameter used by the API. No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is...

CVE-2019-13337: Authorization Bypass Through User-Controlled Key

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter accesstoken this is the parameter used by the API. No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is...

Cross site scripting

An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure PCS 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly...

Cross site scripting

An issue was discovered in Cloudera Manager 5.x through 5.15.0. One type of page in Cloudera Manager uses a 'returnUrl' parameter to redirect the user to another page in Cloudera Manager once a wizard is completed. The validity of this parameter was not checked. As a result, the user could be...

CVE-2018-18838

An issue was discovered in Netdata 1.10.0. Log Injection or Log Forgery exists via a %0a sequence in the url parameter to api/v1/registry...

CVE-2019-6965

An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter...

CVE-2019-6965

An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter...

PT-2019-18384

Name of the Vulnerable Software and Affected Versions i-doit Open version 1.12 Description A cross-site scripting XSS issue was found. The issue is related to the src/tools/php/qr/qr.php API endpoint and the url parameter. Recommendations For i-doit Open version 1.12, consider restricting access ...

CVE-2018-18838: Improper Encoding or Escaping of Output

An issue was discovered in Netdata 1.10.0. Log Injection or Log Forgery exists via a %0a sequence in the url parameter to api/v1/registry...