PT-2022-10081 · Sick · Ftmg Firmware

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue allows unauthenticated users to access sensitive web URLs through a GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensiti...

CVE-2022-25594

Microprogram’s parking lot management system is vulnerable to sensitive information exposure. An unauthorized remote attacker can input specific URLs to acquire partial system configuration information...

WordPress Export All URLs plugin跨站脚本漏洞

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. WordPress plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in versions of the WordPress Export All URLs plugin prior to 4.2, which stems from the plugin's failu...

CVE-2022-25452

Tenda AC6 v15.03.05.09multi was discovered to contain a stack overflow via the URLs parameter in the saveParentControlInfo function...

Samsung Bixby Touch安全漏洞

An access control error vulnerability exists in Samsung Bixby Touch, a virtual intelligent assistant for Samsung mobile devices, which stems from a failure to properly restrict access to resources from unauthorized roles in Bixby Touch. An attacker could exploit the vulnerability to allow untrust...

CVE-2021-44610

Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 URLs, 2 langid, 3 tmplid, 4 modrewrite 5 etadoctype. 6 metacharset, 7 defaultgroup, and 8 page group parameters in the settings mode in admin/index.php...

duck 安全漏洞

Debian duck is used to check URLs. A security vulnerability exists in duck that stems from not properly handling the loading of untrusted code from the current directory...

Jenkins 插件权限许可和访问控制问题漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. an access control error vulnerability in Jenkins autonomiq Plugin 1.15 and earlier versions, which stems from not performi...

The vulnerability in the isolated iframe of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, relates to improper handling of user data. This allows an attacker to perform a spoofing attack.

The vulnerability of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, is related to the improper handling of user data. Exploiting this vulnerability allows a malicious actor to perform a spoofing attack when executing a program and processing an external URL request...

ZTE BigVideo Analysis product 输入验证错误漏洞

ZTE Big Video Analysis Product is a big video analysis product from China's ZTE Corporation ZTE. The ZTE BigVideo Analysis product suffers from an input validation error vulnerability that originates from inconsistent forward and reverse validation when configuring a big screen page, which can be...

ZEIT Next.js 输入验证错误漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. ZEIT Next.js suffers from an input validation error vulnerability that stems from the software's lack of effective handling of incorrectly formatted urls. An invalid or incorrectly...

CVE-2021-43358

Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, access restricted paths and download system files...

CVE-2021-43358

Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, access restricted paths and download system files...

CVE-2021-22049

The vSphere Web Client FLEX/Flash contains an SSRF Server Side Request Forgery vulnerability in the vSAN Web Client vSAN UI plug-in. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an...

curl: Leak of authentication credentials in URL via automatic Referer

It was discovered that libcurl did not remove authentication credentials from URLs when automatically populating the Referer HTTP request header while handling HTTP redirects. This could lead to exposure of the credentials to the server to which requests were redirected...

GHSA-CXFM-5M4G-X7XP A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security...

CVE-2021-3048

Certain invalid URL entries contained in an External Dynamic List EDL cause the Device Server daemon devsrvr to stop responding. This condition causes subsequent commits on the firewall to fail and prevents administrators from performing commits and configuration changes even though the firewall...

SAP Netweaver 输入验证错误漏洞

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform primarily provides a development and runtime environment for SAP applications. An input validation error vulnerability exists in SAP NetWeaver Knowledge Management, which allows...

Obsidian 安全漏洞

Plesk Obsidian is a hosting control panel from the Swiss company Plesk. Obsidian suffers from a security vulnerability that stems from not requiring the user to validate a non-http https url...

OpenStack 输入验证错误漏洞

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration NASA in collaboration with Rackspace in the United States. Openstack Nova suffers from an input validation error vulnerability that allows remote attackers to exploit the vulnerability ...