The vulnerability of the Passwork password manager, related to incorrect restrictions on the path to the restricted catalog, allows a intruder to gain unauthorized access to local files and directories on the server.

The vulnerability of the Passwork password manager is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to local files and directories on the server by manipulating URL...

go-retryablehttp: url might write sensitive information to log file

A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information...

PT-2024-39753 · 3Scale · 3Scale

Name of the Vulnerable Software and Affected Versions: 3Scale affected versions not specified Description: A vulnerability was found in 3Scale where there is no authentication mechanism to view a PDF invoice of a Developer user if the URL is known. This allows anyone to see the invoice if the URL...

CVE-2024-8482

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.3.982 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PhpSpreadsheet 安全漏洞

PhpSpreadsheet is an open source PHP library from PHPOffice for reading and writing spreadsheet files. A security vulnerability exists in PhpSpreadsheet that stems from allowing image size and type to be retrieved by reading the contents of a file. An attacker exploiting this vulnerability can...

The vulnerability of the Git-based software platform for collaborative code development on GitLab allows a hacker to intercept a user’s account credentials.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the redirection of the URL to an unreliable website. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain control of the user account...

CLSA-2024-1727895152 php: Fix of 3 CVEs

CVE-2020-7071: fix URL validation with functions like filtervar$url, FILTERVALIDATEURL - CVE-2021-21705: fix URL validation functionality via filtervar function with FILTERVALIDATEURL parameter when an URL with invalid password field can be accepted as valid - CVE-2024-5458: fix early-out for...

Eclipse GlassFish 输入验证错误漏洞

Eclipse GlassFish is an open source application server from the Eclipse Foundation. An input validation error vulnerability exists in Eclipse GlassFish versions prior to 7.0.17, which stems from a Host HTTP parameter that may cause a web application to redirect to a specified URL when the request...

cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes

A flaw was found in OpenPrinting CUPS. In certain conditions, a remote attacker can add a malicious printer or directly hijack an existing printer by replacing the valid IPP URL with a malicious one. Also, it is possible that due to a lack of validation of IPP attributes returned by the server,...

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE 安全漏洞

The Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE DFS ProGauge MAGLINK LX CONSOLE is an industrial console from Dover Fueling Solutions, USA, designed for expansion. A security vulnerability exists in Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE version 3.4.2.2.6 and prior versions,...

VulnCheck KEV: CVE-2015-8813

The PageLoad function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery SSRF attacks via the url parameter...

VulnCheck KEV: CVE-2023-36542

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission fo...

CVE-2024-45787

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to transmission of sensitive information in plain text in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL and intercepting response of the AP...

Uniong WebITR 输入验证错误漏洞

Uniong WebITR is an online time and attendance system from China Kaifa Uniong. An input validation error vulnerability exists in Uniong WebITR 21027 and prior versions, which stems from the fact that a user can be tricked into redirecting to another page via a spoofed URL, which could lead to a...

Loway QueueMetrics 输入验证错误漏洞

Loway QueueMetrics is a tool from Loway that allows you to automate the installation of a pre-configured QueueMetrics system on the most common Asterisk distributions. An input validation error vulnerability exists in Loway QueueMetrics version 22.11.6, which stems from a URL redirection to an...

go-retryablehttp: url might write sensitive information to log file

A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information...

CVE-2024-5879

The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This...

The vulnerability of Google Chrome’s Picture In Picture technology, which allows a hacker to manipulate the content of a URL string

The vulnerability of Google Chrome’s Picture In Picture technology is related to the distortion of important information in the user interface. Exploiting this vulnerability can allow a malicious actor to manipulate the content of the URL string using a specially created HTML page...

QR Code Bookmark System 跨站脚本漏洞

QR Code Bookmark System is a QR code bookmark system for rems individual developers. A cross-site scripting vulnerability exists in SourceCodester QR Code Bookmark System version 1.0, which originates from a cross-site scripting vulnerability in the tblbookmarkid/name/url parameter of the...

Learning with Texts 安全漏洞

Learning with Texts LWT is a software application by the individual developer Jon Gauthier. It allows users to import text, read, save, view and test words and expressions in multiple languages. A security vulnerability exists in Learning with Texts version 2.0.3, which stems from not filtering...