469 matches found
CVE-2020-2160: Cross-Site Request Forgery (CSRF)
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL...
CSRF protection for any URL could be bypassed
An extension point in Jenkins allows selectively disabling cross-site request forgery CSRF protection for specific URLs. Implementations of that extension point received a different representation of the URL path than the Stapler web framework uses to dispatch requests in Jenkins 2.227 and earlie...
PT-2020-2656 · Cloudbees +1 · Jenkins
Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.227 and earlier Jenkins LTS versions 2.204.5 and earlier Description: The issue is related to the absence of protection against cross-site request forgery CSRF in Jenkins. This allows attackers to craft URLs that bypass CSR...
CVE-2019-4745: Incorrect Authorization
IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosing path information in the URL. IBM X-Force ID: 172883...
httpd: URL normalization inconsistency
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes '/', directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing wi...
Code injection
Bulb Security Smartphone Pentest Framework SPF before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to 1 remoteAttack.pl or 2 guessPassword.pl in frameworkgui/; the filename parameter to 3 CSAttack.pl or 4 SEAttack.pl in...
CVE-2019-18955
The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019...
CVE-2019-18955
The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019...
CVE-2019-18955
Affected product: Lansweeper Web Console (version 7.2.105.2). Vulnerability: Cross-Site Scripting (XSS) via the URL path, stemming from improper handling of client-side data in the web console. Impact as described in sources is limited to client-side script execution; no server-side compromise de...
CVE-2019-18955: Improper Neutralization of Input During Web Page Generation
The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019...
httpd: URL normalization inconsistency
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes '/', directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing wi...
Directory Traversal
flow-server is vulnerable to directory traversal. The attack is possible due to a lack of proper validation of URL path in StaticFileServer, allowing an attacker to inject ../ characters into in parameters to access resources outside of the web root...
Cross-site Scripting (XSS)
iobroker.web is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize the characters in the URL path, allowing an attacker to inject arbitrary script through it...
CVE-2019-10771
Characters in the GET url path are not properly escaped and can be reflected in the server response...
CVE-2019-10771
Characters in the GET url path are not properly escaped and can be reflected in the server response...
Design/Logic Flaw
Characters in the GET url path are not properly escaped and can be reflected in the server response...
CVE-2019-10771: Improper Neutralization of Input During Web Page Generation
Characters in the GET url path are not properly escaped and can be reflected in the server response...
httpd: URL normalization inconsistency
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes '/', directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing wi...
python: CRLF injection via the path part of the url passed to urlopen()
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the path component of a URL that...