XWiki Platform Code Injection Vulnerability

XWiki Platform is a suite of Wiki platforms from the XWiki Foundation in France for creating collaborative Web applications. A code injection vulnerability exists in XWiki Platform 1.0 and later versions that could allow an attacker with programming privileges to execute arbitrary code on the...

XWiki Platform Security Vulnerability

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform that stems from not properly escaping a URL parameter in the code used to display the administration section...

SUSE CVE-2017-6059

Modauthopenidc.c in the Ping Identity OpenID Connect authentication module for Apache aka modauthopenidc before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request...

CVE-2023-21364

creationtimestamp| type| source ---|---|--- 2023-10-30 19:19:44+00:00| seen| https://t.me/cibsecurity/73137 2025-08-10 06:14:12+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lvzmve3ptmf2...

The vulnerabilities of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are related to deficiencies in access control. These vulnerabilities allow attackers to redirect users to any desired URL address.

The vulnerabilities of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are related to deficiencies in access control. Exploiting these vulnerabilities allows a malicious actor to redirect a user to an arbitrary URL using a specially created extension...

CVE-2023-46659

Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

PT-2023-7250 · Zyxel · Zyxel Usg Flex Series +4

Name of the Vulnerable Software and Affected Versions: ZyXEL USG FLEX series firmware versions 4.50 through 5.37 ZyXEL USG FLEX 50W series firmware versions 4.16 through 5.37 ZyXEL USG20W-VPN series firmware versions 4.16 through 5.37 ZyXEL VPN series firmware versions 4.30 through 5.37 ZyXEL ATP...

PT-2023-32240 · Facebook · React Developer Tools

Name of the Vulnerable Software and Affected Versions: React Developer Tools extension affected versions not specified Description: The React Developer Tools extension has a message listener registered with window.addEventListener'message', in a content script accessible to any active webpage in...

CVE-2022-48612

A Universal Cross Site Scripting UXSS vulnerability in ClassLink OneClick Extension through 10.7 allows remote attackers to inject JavaScript into any webpage, because a regular expression validating whether a URL is controlled by ClassLink is not present in all applicable places...

Server-side Request Forgery (SSRF)

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the injection of arbitrary URLs. An attacker can read files outside the application's path boundary by forcing...

DEBIAN-CVE-2023-32721

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...

UBUNTU-CVE-2023-32721

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...

The vulnerability of the allowed_urls configuration in the PyTorch TorchServe training and scaling tool allows a attacker to perform an SSRF attack.

The vulnerability of the allowedurls configuration in PyTorch TorchServe’s model servicing and scaling tools is related to insufficient validation of incoming requests during URL verification. Exploiting this vulnerability could allow a remote attacker to execute an SSRF attack...

fsevents Code Injection Vulnerability

fsevents is a library of fsevents open source. A code injection vulnerability exists in versions prior to fsevents 1.2.11 that stems from allowing an attacker to execute arbitrary code via a URL...

PT-2023-29492

Name of the Vulnerable Software and Affected Versions fsevents versions prior to 1.2.11 Description The issue arises from fsevents depending on a specific URL, https://fsevents-binaries.s3-us-west-2.amazonaws.com, which could potentially allow an adversary to execute arbitrary code if a JavaScrip...

PT-2023-28985 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 2023.9.0 Description: Misskey is an open source, decentralized social media platform. A user can bypass the authentication of the Bull dashboard, which is the job queue management UI, by editing the URL. This allows...

CVE-2023-33270

An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the Curl check function is vulnerable to OS command injection blind...

CVE-2023-33273

An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the WGET check function is vulnerable to OS command injection blind...

LemonLDAP::NG Code Issue Vulnerability

LemonLDAP::NG is a web single sign-on and access management software. A code issue vulnerability exists in LemonLDAP::NG versions prior to 2.17.1. An attacker could use this vulnerability to send a GET request to an arbitrary URL via the requesturi authorization parameter...

Acronis Cyber Protect Security Vulnerability

Acronis Cyber Protect is an all-in-one cyber protection solution for business and enterprise from Acronis Singapore. It combines backup, anti-malware, network security and endpoint management features such as vulnerability assessment, URL filtering, patch management and more. A security...