The vulnerability of the wp_kses_bad_protocol_once function in the WordPress content management system allows a hacker to compromise data integrity.

The vulnerability of the wpksesbadprotocolonce function in the WordPress content management system is related to improper cleaning of URL addresses, which could lead to the reproduction of XSS attacks. Exploiting this vulnerability could allow an attacker to compromise data integrity...

DEBIAN-CVE-2020-12474

Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL...

git: Crafted URL containing new lines, empty host or lacks a scheme can cause credential leak

A flaw was found in git where credentials can be leaked through the use of a crafted URL. The crafted URL must contain a newline, empty host, or lack a scheme so that the credential helper is fulled into giving the information of a different host to the client. The highest threat from this...

git: Crafted URL containing new lines, empty host or lacks a scheme can cause credential leak

A flaw was found in git where credentials can be leaked through the use of a crafted URL. The crafted URL must contain a newline, empty host, or lack a scheme so that the credential helper is fulled into giving the information of a different host to the client. The highest threat from this...

git: Crafted URL containing new lines can cause credential leak

A flaw was found in git. Credentials can be leaked through the use of a crafted URL that contains a newline, fooling the credential helper to give information for a different host. Highest threat from the vulnerability is to data confidentiality...

git: Crafted URL containing new lines can cause credential leak

A flaw was found in git. Credentials can be leaked through the use of a crafted URL that contains a newline, fooling the credential helper to give information for a different host. Highest threat from the vulnerability is to data confidentiality...

Squid Double Decode Bypass Vulnerability

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in Squid 4.7 and earlier versions. An attacker can exploit this vulnerability to bypas...

VMware vRealize Log Insight Input Validation Error Vulnerability

VMware vRealize Log Insight provides real-time log management capabilities for VMware environments. An input validation error vulnerability exists in VMware vRealize Log Insight, which stems from the program's inability to properly validate user input. An attacker could exploit the vulnerability...

SAP NetWeaver AS ABAP Business Server Input Validation Error Vulnerability

SAP NetWeaver AS ABAP Business Server is an application server for ABAP Advanced Business Application Programming from SAP, Germany. An input validation error vulnerability exists in SAP NetWeaver AS ABAP Business Server Pages Test Application IT00. The vulnerability stems from the network system...

Advantech WebAccess/NMS Path Traversal Vulnerability (CNVD-2020-22313)

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A path traversal vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by an attacker with a specially crafted URL to delete files beyond the control of the...

CVE-2020-7625

op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function...

libreoffice: Insufficient URL decoding flaw in categorizing macro location

LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in...

libreoffice: Insufficient URL validation allowing LibreLogo script execution

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on...

CVE-2020-10510

Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. After login, attackers can use a specific URL, access unauthorized functionality and data...

Sunnet eHRD Improper Access Control Vulnerability

Sunnet eHRD is a talent training and development management system. An improper access control vulnerability exists in Sunnet eHRD. An authenticated attacker could exploit the vulnerability to access unauthorized functionality and data via a specific URL...

Sunnet eHRD Information Disclosure Vulnerability

Sunnet eHRD is a talent training and development management system. An information disclosure vulnerability exists in Sunnet eHRD. The vulnerability stems from eHRD improperly storing system files. An attacker can exploit the vulnerability to obtain confidential information via a specific URL...

PT-2020-20363 · Google · Google Closure Library

Name of the Vulnerable Software and Affected Versions: Google Closure Library versions up to and including v20200224 Description: A URL parsing issue in goog.uri of the Google Closure Library allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority...

PT-2020-2412 · Php +8 · Php +8

Name of the Vulnerable Software and Affected Versions: PHP versions 7.2.x through 7.2.28 PHP versions 7.3.x through 7.3.15 PHP versions 7.4.x through 7.4.3 Description: The issue is related to the implementation of the get headers function in PHP, which does not properly check user-supplied URLs...

CVE-2019-13197

Some Kyocera printers such as the ECOSYS M5526cdw 2R72000.001.701 were affected by a buffer overflow vulnerability in the URI paths of the web application that would allow an unauthenticated attacker to perform a Denial of Service attack, crashing the device, or potentially execute arbitrary code...

CVE-2020-6643

An improper neutralization of input vulnerability in the URL Description in Fortinet FortiIsolator version 1.2.2 allows a remote authenticated attacker to perform a cross site scripting attack XSS...