484 matches found
CVE-2020-27627
JetBrains TeamCity prior to 2020.1.2 is described as vulnerable to URL injection (CVE-2020-27627). The connected Red Hat, CNVD, NVD, and CVE listings reiterate that versions before 2020.1.2 are affected, but do not provide technical details about the vulnerability’s root cause, affected component...
Status.im: HTTP Parameter Pollution with semicolons in iframe allows loading external Greenhouse forms
Summary: Status.im uses Greenhouse for job applications, specifically the older Greenhouse integration which relies on iframes. The ghjid URL parameter is used to load the correct form in the iframe. HTML characters are escaped, but using semicolons you can inject URL parameters into the iframe v...
Security Policy Bypass
firefox:bionic is vulnerable to security policy bypass. By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security Policy CSP...
Cross-Site Scripting in yui
Affected versions of yui are vulnerable to cross-site scripting in the uploader.swf and io.swf utilities, via script injection in the url. Recommendation YUI has published their recommendation to fix this issue. Their recommendation is to: - Delete self-hosted copies of these files if you are not...
EMC RSA Archer < 6.5.0.7, < 6.6.0.6 and < 6.7.0.1 Multiple Vulnerabilities
The version of EMC RSA Archer running on the remote web server is prior to 6.7.0.3 6.7 P3 or 6.6 P6 6.6.0.6. It is, therefore, affected by multiple vulnerabilities: - RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL injection vulnerability. An unauthenticated remote attacker could...
UBUNTU-CVE-2020-15693
In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call such as httpClient.get or httpClient.post, the User-Agent header value, or custom HTTP header names or value...
CVE-2019-17339
The CVE-2019-17339 issue affects TIBCO Silver Fabric, specifically the VirtualRouter component, with an XSS-like vulnerability that could let an attacker inject scripts via URLs submitted by an authenticated user. Affected releases are Silver Fabric 6.0.0 and earlier. The vulnerability’s impact i...
CVE-2020-10715
A content spoofing vulnerability was found in the openshift/console. This flaw allows an attacker to craft a URL and inject arbitrary text onto the error page that appears to be from the OpenShift instance. This attack could potentially convince a user that the inserted text is legitimate...
Nagios Core < 4.4.6 Multiple Vulnerabilities
Nagios Core is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nagios:nagios"; ifdescription...
Code injection
All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. package.json...
CVE-2020-5336
RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious JavaScript code on the affected system...
CVE-2020-5336
RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious JavaScript code on the affected system...
Design/Logic Flaw
RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious JavaScript code on the affected system...
CVE-2020-5336
CVE-2020-5336 affects Dell EMC RSA Archer versions prior to 6.7.0.1 (6.7 P1). The vulnerability is a URL injection that could allow an unauthenticated attacker to trick a victim application user into executing malicious JavaScript in the context of the web application. Connected documents corrobo...
CVE-2020-5336
RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious JavaScript code on the affected system...
CVE-2020-5336
RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious JavaScript code on the affected system...
Engel & Völkers Technology GmbH: [go3-stage.engelvoelkers.com] - Reflected XSS in /dGPS3/default.jsp
Summary: The application fails to sanitize user input in https://go3-stage.engelvoelkers.com/dGPS3/default.jsp and reflect the input directly in the HTTP response, allowing the hacker to exploit the vulnerable parameter and have malicious content executed in the victim's browser. Description: A...
Cross-Site Scripting (XSS)
cxf-rt-transports-http is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via an endpoint addresses and URL...
Red Hat JBoss Enterprise Application Platform 7.x < 7.2.2 Multiple Vulnerabilities
The version of Red Hat JBoss Enterprise Application Platform EAP installed on the remote host is 7.x prior to 7.2.2. It is therefore, affected my multiple vulnerabilities as referenced in the RHSA-2019:1424 advisory: - picketlink: reflected XSS in SAMLRequest via RelayState parameter CVE-2019-387...