Sourceforge PhpGACL Cross-Site Scripting Vulnerability

Sourceforge PhpGACL is a pluggable platform based on Php, Mysql used to provide access control for platforms organized by Sourceforge. A security vulnerability exists in phpGACL 3.3.7, which can be exploited by an attacker who can provide a crafted URL to trigger the vulnerability...

CVE-2021-22871

Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting XSS vulnerability...

LOGITEC CORPORATION LAN-W300N/PR5B Security Breach

A security vulnerability exists in the LOGITEC CORPORATION LAN-W300N / PR5B. When a user logged into the device management web page accesses a specially crafted URL, a denial of service may result...

Quali CloudShell 跨站脚本漏洞

Quali CloudShell is a cloud service from Quali USA for managing infrastructure provisioning, cloud orchestration, automated deployments and more in cloud environments. A cross-site scripting vulnerability exists in Quali CloudShell version 9.3 that originates on the login page and can be exploite...

IBM Security Guardium Data Encryption Information Disclosure Vulnerability

IBM Security Guardium Data Encryption GDE provides a modular set of encryption solutions that help security teams effectively implement data-at-rest security across the organization. An information disclosure vulnerability exists in IBM Security Guardium Data Encryption 3.0.0.2. The vulnerability...

Cloudbees Jenkins Cross-Site Scripting Vulnerability (CNVD-2021-03558)

Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . A cross-site scripting vulnerabilit...

PT-2021-14652 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.274 and earlier, LTS versions 2.263.1 and earlier Description: The issue allows attackers without Overall/Read permission to access some URLs as if they had Overall/Read permission due to incorrect matching of requested URL...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2021-03029)

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An information disclosure vulnerability exists in IBM Spectrum Protect Plus 10.1.0-10.1.6. An attacker can explo...

IBM Spectrum Protect Plus 信息泄露漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An information disclosure vulnerability exists in IBM Spectrum Protect Plus 10.1.0-10.1.6. An attacker can explo...

Digisol Systems DG-HR3400 Cross-Site Scripting Vulnerability

Digisol Systems DG-HR3400 is a wireless router from Digisol Systems, India. The Digisol DG-HR3400 suffers from a cross-site scripting vulnerability that originates from the NTP server name in the system time and the "keyword" in the URL filter...

HGiga MailSherlock SQL Injection Vulnerability

HGiga MailSherlock is an email archiving and auditing system that provides a complete email security solution. HGiga MailSherlock suffers from a SQL injection vulnerability. An attacker can use this vulnerability to inject and execute SQL commands in the URL parameters of a specific cgi page...

Dell Wyse Management Suite 输入验证错误漏洞

Wyse Management Suite is a next-generation management solution that enables you to centrally configure, monitor, manage and optimize Wyse thin clients. An open redirection vulnerability exists in Wyse Management Suite versions prior to 3.1. An attacker could exploit this vulnerability by tricking...

CVE-2020-35742

HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter...

The vulnerability of the spam protection mechanism in the Cisco AsyncOS operating system of the Cisco Email Security Appliance (ESA) allows a hacker to bypass the URL filtering.

The vulnerability of the spam protection mechanism in Cisco’s operating system, Cisco AsyncOS, within Cisco Email Security Appliance ESA, is related to errors during the validation of incoming URL addresses. Exploiting this vulnerability could allow a malicious actor to bypass the URL filtering...

python-django-horizon: dashboard allows open redirect

A flaw was found in python-django-horizon. The "next" parameter is not correctly validated allowing a remote attacker to supply a malicious URL in the dashboard that could cause an automatic redirect to the provided malicious site. The highest threat from this vulnerability is to data...

PT-2020-16518 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP versions 740 through 754 Description: The issue arises from insufficient URL encoding, allowing an attacker to input malicious JavaScript in the URL. This could result in the execution of the malicious script in the...

OpenStack Horizon Input Validation Error Vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration NASA in collaboration with Rackspace in the United States. A security vulnerability exists in OpenStack Horizon versions 15.3.2,16 before, which stems from a lack of validation of the...

GHSA-R2J6-P67H-Q639 Secret disclosure when containing characters that become URI encoded

Impact Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL. Patches Fixed in v17.2.3 Workarounds Secrets that do not contain characters that become encoded when included in a URL are already...

PYSEC-2020-157

Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL...

Pallets Werkzeug 输入验证错误漏洞

Werkzeug is a comprehensive library for WSGI web applications. werkzeug versions prior to 0.11.6 are vulnerable to redirection. An attacker could exploit the vulnerability to redirect users to an arbitrary url via a double slash in the URL...