CVE-2021-37212

The bulletin function of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific Url parameters and access and modify bulletin particular content...

Reflected Cross-Site Scripting

Overview There is an XSS vulnerability in affected versions of auth0-lock. Overview Versions before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's - flashMessage feature is utilized and user input or data from URL parameters is...

Reflected XSS when using flashMessages or languageDictionary

Overview Versions before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's - flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage. - languageDictionary feature is utilized a...

CVE-2021-32641: Improper Neutralization of Input During Web Page Generation

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage ...

@molgenis-ui/core-ui (>=0.2.2, <=0.5.3), @molgenis/core-ui (0.2.4) +12 more potentially affected by CVE-2021-20087 via jquery-deparam (>=0.1.0, <=0.5.3)

jquery-deparam NPM version =0.1.0, =0.2.2, =0.1.0, =0.0.1, =1.0.1, =1.2.1, =1.4.4, =1.0.0, =1.0.0, =1.2.1, =0.0.6, =0.3.8, =0.17.22 Source cves: CVE-2021-20087 Source advisory: GHSA-XG68-CHX2-253G...

CVE-2021-1358

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected system. A...

Cisco Finesse Open Redirect Vulnerability

Cisco Finesse is a next-generation seat and supervisor desktop designed to provide a collaborative experience for the diverse communities that interact with your customer service organization. An open redirection vulnerability exists in the Web management interface of Cisco Finesse 12.61 and...

Cross-site Scripting (XSS) - Reflected in blockonomics/woocommerce-plugin

✍️ Description Reflected javascript injection vulnerabilities exist when web applications take parameters from the URL and display them on a page. Reflection vulnerabilities occur when a website outputs a variable from the webpage URL directly to the page, such as in a PHP application that accepts...

CVE-2021-30167

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices...

CVE-2021-30167

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices...

Information disclosure

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s information and escalate privileges to control the devices...

CVE-2021-30167

The CVE-2021-30167 entry describes an authentication-based vulnerability in MERIT LILIN IP cameras where the manage users profile services allow an authenticated remote attacker to modify URL parameters and amend user information, enabling privilege escalation to control the device. Affected prod...

CVE-2020-28898

In QED ResourceXpress through 4.9k, a large numeric or alphanumeric value submitted in specific URL parameters causes a server error in script execution due to insufficient input validation...

CVE-2020-28898

In QED ResourceXpress through 4.9k, a large numeric or alphanumeric value submitted in specific URL parameters causes a server error in script execution due to insufficient input validation...

Input validation

In QED ResourceXpress through 4.9k, a large numeric or alphanumeric value submitted in specific URL parameters causes a server error in script execution due to insufficient input validation...

CVE-2020-28898: Improper Input Validation

In QED ResourceXpress through 4.9k, a large numeric or alphanumeric value submitted in specific URL parameters causes a server error in script execution due to insufficient input validation...

PT-2021-17790

Name of the Vulnerable Software and Affected Versions: Mitake smart stock selection system affected versions not specified Description: The issue allows remote attackers to gain privileged permissions by manipulating parameters in the URL, enabling access to transaction records and fraudulent...

pki-core: Reflected XSS in getcookies?url= endpoint in CA

A Reflected Cross Site Scripting vulnerability was found in the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute...

CVE-2019-10221 Pki-core: Reflected XSS In Getcookies?url= Endpoint In CA

pki-core is vulnerable to cross-site scripting. The vulnerability exists due to a missing sanitization of the GET URL parameters...

USN-4442-2 sympa vulnerabilities

USN-4442-1 fixed vulnerabilities in Sympa. This update provides the corresponding updates for Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. Original advisory details: Nicolas Chatelain discovered that Sympa incorrectly handled environment variables. An attacker could possibly use this...