CVE-2022-34770

Tabit - sensitive information disclosure. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described API’s, has in its URL one or more MongoD...

CVE-2022-2600

The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object...

CVE-2021-3639

A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threa...

AZL-36962 CVE-2021-3639 affecting package mod_auth_mellon for versions less than 0.16.0-4

A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threa...

CVE-2021-3639

A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threa...

Design/Logic Flaw

A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threa...

CVE-2022-2600

The CVE-2022-2600 entry concerns the WordPress plugin Auto-hyperlink URLs (versions through 5.4.1). The underlying issue is that generated links do not include rel="noopener noreferer", enabling Tab Nabbing and potentially exposing the source tab via window.opener. The vulnerability impact, as do...

CVE-2021-3639

A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threa...

PT-2022-22327 · Tabit · Tabit

Name of the Vulnerable Software and Affected Versions: Tabit affected versions not specified Description: The issue concerns several APIs on the web system that display sensitive information without authorization, including health statements, previous bills in a specific restaurant, alcohol...

CVE-2022-35151

kkFileView v4.1.0 was discovered to contain multiple cross-site scripting XSS vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java...

CVE-2022-35151

kkFileView v4.1.0 was discovered to contain multiple cross-site scripting XSS vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java...

CVE-2022-35151

kkFileView v4.1.0 was discovered to contain multiple cross-site scripting XSS vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java...

CVE-2022-38184

There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs...

Improper access control

There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs...

PT-2022-4367 · Esri · Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Portal for ArcGIS versions 10.8.1 and below Description: The issue is related to improper access control in Portal for ArcGIS, which could allow a remote, unauthenticated attacker to access an API. This may induce Esri Portal for ArcGIS to re...

Esri Portal For ArcGis 安全漏洞

Esri Portal For ArcGis is a component from Esri, Inc. that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A security vulnerability exists in Portal for ArcGIS version 10.8.1 and earlier, which stems from the presence of an...

CVE-2022-38358

Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting attacks at /module/adminnotifiers/rules.php and /module/reportevent/indext.php via the parameters rulenotification, rulename, and rulenameold, and at...

Design/Logic Flaw

Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs...

PT-2022-5831 · Zoom · Zoom Client For Meetings +1

Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings versions prior to 5.11.0 Description: The issue is related to a URL parsing problem. If a malicious Zoom meeting URL is opened, it may direct the user to connect to an arbitrary network address, potentially leading to...

Photo Gallery < 1.7.1 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC When the plugin displays a notice: https://example.com/wp-admin/plugins.php?"...