CVE-2017-16134: Improper Limitation of a Pathname to a Restricted Directory

httpstaticsimple is an http server. httpstaticsimple is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16174: Improper Limitation of a Pathname to a Restricted Directory

whispercast is a file server. whispercast is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16190: Improper Limitation of a Pathname to a Restricted Directory

dcdcdcdcdc is a static file server. dcdcdcdcdc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16038: Improper Limitation of a Pathname to a Restricted Directory

f2e-server 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. This is compounded by f2e-server requiring elevated privileges to run...

shop.falter.at XSS vulnerability

Open Bug Bounty ID: OBB-626454 Description| Value ---|--- Affected Website:| shop.falter.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cross site scripting

Cross-site scripting XSS vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html...

CVE-2018-11581

Cross-site scripting XSS vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html...

CVE-2018-11581

Cross-site scripting XSS vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html...

CVE-2018-11581

Mode C: CVE-2018-11581 affects Brother HL series printers, with a cross-site scripting (XSS) flaw exploitable via the url parameter to etc/loginerror.html. The root cause is an unsanitized input reflected in the printer’s web UI, enabling injection of arbitrary script/HTML. Multiple connected sou...

CVE-2018-11628

EMS Master Calendar before 8.0.0.201805210 is affected by a cross-site scripting (XSS) vulnerability where data input via URL parameters is not properly sanitized. Root cause: insufficient input filtering in the web application, enabling a crafted URL to execute script in a user’s browser. Docume...

PT-2018-10683

Name of the Vulnerable Software and Affected Versions Brother HL series printers affected versions not specified Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the url parameter to "etc/loginerror.html". Recommendations At the momen...

CVE-2018-11581: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html...

Atlassian Application Links Cross-Site Scripting Vulnerability (CNVD-2018-10218)

Atlassian Application Links is a plug-in from Atlassian Australia that is used in Atlassian products to create buttons that connect to other applications. A cross-site scripting vulnerability exists in the invalidRedirectUrl template in Atlassian Application Links versions prior to 5.2.7, 5.3.0...

Open redirect

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...

CVE-2015-8094

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...

CVE-2015-8094

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...

CVE-2018-10240

SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session...

PT-2018-9778

Name of the Vulnerable Software and Affected Versions: SolarWinds Serv-U MFT versions prior to 15.1.6 HFv1 Description: The issue allows an attacker to brute-force a low-entropy session token assigned to authenticated users. This token can be used in requests as a URL parameter instead of a sessi...

CVE-2018-9302

SSRF Server Side Request Forgery in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14611, which was about...

CVE-2018-9302

SSRF Server Side Request Forgery in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14611, which was about...