CVE-2022-41215

SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information...

Astra Linux - уязвимость в firefox, thunderbird

Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first This vulnerability affects Firefox for iOS 136...

iTop 输入验证错误漏洞

iTop is a simple, web-based IT service management tool from Combodo open source. An input validation error vulnerability exists in iTop version 3.2.0, which stems from the possibility that an attacker could send a URL resulting in a PHP error...

Jenkins plugin Cadence vManager 安全漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security...

firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack...

U.S. Dept Of Defense: SQL Injection via URL

A SQL injection vulnerability was discovered in the website's URL. The vulnerability allowed manipulation of SQL queries executed by the backend database. The vulnerability was demonstrated by changing the sleep value, which resulted in longer or shorter delays in the page loading...

CVE-2025-44863

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

TOTOLINK CA300-PoE 安全漏洞

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the msgprocess function Url parameter failing to correctly filter constructive command special characters, commands, etc., which...

TOTOLINK CA600-PoE 安全漏洞

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the msgprocess function Url parameter failing to properly filter construct command special characters, commands, etc. No...

Improper Authentication

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Authentication. An attacker can circumvent required actions configured by an administrator such as...

The vulnerability of the Jenkins automation server lies in the redirection of URLs to an unreliable website, allowing attackers to redirect users to arbitrary URL addresses.

The vulnerability of the Jenkins automation server relates to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses...

firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack...

IBM InfoSphere Information Server 安全漏洞

IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. A plaintext transfer vulnerability exists in IBM InfoSphere Information Server version 11.7, whi...

CVE-2024-46546

NEXTU FLETA AX1500 WIFI6 Router v1.0.3 was discovered to contain a stack overflow via the url parameter at /boafrm/formFilter. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2025-20236

A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient inpu...

Improper Validation of Specified Type of Input

Overview validator is a library of string validators and sanitizers. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the isURL function which does not take into account : as the delimiter in browsers. An attackers can bypass protocol and domai...

AIAS 代码问题漏洞

AIAS is an AI one-stop solution from Calvin Personal Developers. AIAS version 20250308 suffers from a code issue vulnerability that stems from the fact that incorrect manipulation of the parameter url can lead to server-side request forgery...

firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack...

The vulnerability in the web interface for managing micro-program software on Cisco Expressway allows a hacker to redirect users to any arbitrary URL address.

The vulnerability of the web interface for managing microprogramming software in Cisco Expressway is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to redirect users to any arbitrary URL address...

go-git: argument injection via the URL field

An argument injection vulnerability was found in go-git. This flaw allows an attacker to set arbitrary values to git-upload-pack flags, leading to command or code execution, exposure of sensitive data, or other unintended behavior. This is only possible in configurations where the file transport...