2338 matches found
IBM API Connect Phishing Attack Vulnerability
IBM API Connect is a comprehensive end-to-end API lifecycle solution. A phishing attack vulnerability exists in IBM API Connect 2018.4.1.0 through 2018.4.1.12, which can be exploited by an attacker to conduct a phishing attack by tricking the server into generating a user registration email...
IBM Security Guardium Insights Information Disclosure Vulnerability (CNVD-2020-49353)
IBM Security Guardium Insights is a modern hybrid cloud data security hub designed to provide a reliable view of an organization's data security and compliance posture. An information disclosure vulnerability exists in IBM Security Guardium Insights 2.0.1. The vulnerability stems from the product...
CVE-2020-4172
IBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 174408...
CVE-2020-3440
A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an unauthenticated, remote attacker to overwrite arbitrary files on an end-user system. The vulnerability is due to improper validation of URL parameters that are sent from a website to the affected application. An attack...
CVE-2020-17384
Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With the cookie of the system administrator, attackers can inject and remotely execute arbitrary command to manipulate the system...
CVE-2020-5540
Cross-site scripting vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to inject arbitrary script or HTML via a specially crafted URL...
IBM Planning Analytics Clickjacking Vulnerability
IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. A clickjacking vulnerability exists in IBM Planning Analytics version 2.0.x. The vulnerability ste...
The vulnerability of the WordPress website content management system, related to the redirection of URLs to an unreliable website, allows attackers to access sensitive data and compromise its integrity.
The vulnerability of the WordPress website content management system is related to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to gain access to confidential data and compromise its integrity...
wildfly-elytron: session fixation when using FORM authentication
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as...
Unspecified Vulnerability in WebKit Page Loading Component of Multiple Apple Products
Apple Safari is a web browser that is the default browser that comes with Mac OS X and iOS. apple iOS is an operating system developed for mobile devices. apple tvOS is a smart TV operating system. webKit Page Loading is one of the page loading components. A security vulnerability exists in the...
ovirt-engine: Redirect to arbitrary URL allows for phishing
An Open redirect vulnerability was found in ovirt-engine versions 4.4.1 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks. Once the target has opened the malicious URL in their browser, the critical part of the URL is no longer...
DRUPAL-CONTRIB-2020-027
This module enables you to use the current URL path alias and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website. The module doesn't sufficiently sanitize editor input in certain circumstances leading ...
CVE-2020-15803
Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget...
Mozilla: Information disclosure due to manipulated URL object
The Mozilla Foundation Security Advisory describes this flaw as: Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript...
Mozilla: Information disclosure due to manipulated URL object
The Mozilla Foundation Security Advisory describes this flaw as: Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript...
grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL
An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the same issue can create a NULL pointer...
UBUNTU-CVE-2020-15095
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "://:@::/". The password value is not redacted and is printed to stdout and also to any generated log files...
Mozilla: Information disclosure due to manipulated URL object
The Mozilla Foundation Security Advisory describes this flaw as: Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript...
Mozilla: Information disclosure due to manipulated URL object
The Mozilla Foundation Security Advisory describes this flaw as: Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript...