CVE-2022-41204

An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack...

CVE-2022-26121

An exposure of resource to wrong sphere vulnerability CWE-668 in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11, 5.6.0 through 5.6.11 may allow an unauthenticated and remote attacker to access report template images via...

Cowell enterprise travel management system 跨站脚本漏洞

Cowell enterprise travel management system Cowell information enterprise travel management system is a China Cowell information Cowell company's enterprise travel management system. The Cowell enterprise travel management system suffers from a cross-site scripting vulnerability that stems from...

Mozilla: Data-race when parsing non-UTF-8 URLs in threads

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that concurrent use of the URL parser with non-UTF-8 data was not thread-safe, leading to a use-after-free problem and causing a potentially exploitable crash...

Mozilla: Data-race when parsing non-UTF-8 URLs in threads

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that concurrent use of the URL parser with non-UTF-8 data was not thread-safe, leading to a use-after-free problem and causing a potentially exploitable crash...

Mozilla: Data-race when parsing non-UTF-8 URLs in threads

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that concurrent use of the URL parser with non-UTF-8 data was not thread-safe, leading to a use-after-free problem and causing a potentially exploitable crash...

Mozilla: Data-race when parsing non-UTF-8 URLs in threads

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that concurrent use of the URL parser with non-UTF-8 data was not thread-safe, leading to a use-after-free problem and causing a potentially exploitable crash...

PYSEC-2022-279

In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...

Mozilla Firefox 资源管理错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a memory misreference vulnerability that stems from concurrent use of the URL parser for non-UTF-8 data not being thread-safe. An attacker could exploit the vulnerability t...

nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets

A flaw was found in the got package for node.js. Requested URLs are not verified and allow open redirection to a local UNIX socket...

CVE-2022-25765

The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized...

PT-2022-23609 · Xiaomi · Xiaomi Mi Browser

Name of the Vulnerable Software and Affected Versions: Xaomi Mi Browser version 13.10.0-gn Description: The issue allows attackers to execute arbitrary code via user interaction with a crafted URL. Recommendations: For Xaomi Mi Browser version 13.10.0-gn, at the moment, there is no information...

UBUNTU-CVE-2022-39049

An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS...

CVE-2022-39196

Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by entering student credentials and then directly visiting a certain webapps/bbcms/execute/ URL. Note: The vendor disputes this stating this cannot be reproduced...

CVE-2022-36200

In FiberHome VDSL2 Modem HG150-UbV3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed...

FiberHome VDSL2 Modem HG150-Ub 安全漏洞

The FiberHome VDSL2 Modem HG150-Ub is a piece of router equipment from FiberHome. A security vulnerability exists in the FiberHome VDSL2 Modem HG150-UbV3.0 version, which stems from the fact that an administrator's credentials can be submitted in a URL and can be logged, sniffed, and sniffed...

Red Hat JBoss Core Services 信息泄露漏洞

Red Hat JBoss Core Services is software that complements the suite of Red Hat JBoss middleware products from Red Hat, Inc. An information disclosure vulnerability exists in all versions of Red Hat JBoss Core Services HTTP Server that stems from its failure to properly specify the path component o...

GHSA-MV48-HCVH-8JJ8 Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service...

VulnCheck KEV: CVE-2021-20166

Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton...

The vulnerability of the Jenkins Openstack Heat Plugin is related to deficiencies in the authentication process, allowing attackers to replace the URL address.

The vulnerability of the Jenkins Openstack Heat Plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to remotely replace the URL address...