CVE-2020-28043

MISP through 2.4.133 allows SSRF in the REST client via the usefullpath parameter with an arbitrary URL...

CVE-2020-28043: Server-Side Request Forgery (SSRF)

MISP through 2.4.133 allows SSRF in the REST client via the usefullpath parameter with an arbitrary URL...

CVE-2020-5784

Server-Side Request Forgery in Teltonika firmware TRB2R00.02.04.3 allows a low privileged user to cause the application to perform HTTP GET requests to arbitrary URLs...

CVE-2020-2272: Missing Authorization

A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

CVE-2020-2255: Missing Authorization

A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...

Yodobashi App for Android fails to restrict access permissions

Overview Yodobashi App for Android provided by Yodobashi Camera Co.,Ltd. implements the function to access a requested URL using an Intent. This function contains an improper access control vulnerability CWE-284 that may allow the vulnerable App to receive an Intent from an arbitrary App and to...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-50965)

Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. Ignite Realtime Openfire 4.5.1 suffers from a stored cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary malicious URLs...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-50966)

Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A cross-site scripting vulnerability exists in Ignite Realtime Openfire 4.5.1, which can be exploited by an attacker via the "searchName", "searchValue", " searchDescription",...

CVE-2020-24601

In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias" in the import certificate trusted page...

CVE-2020-5623

NITORI App for Android versions 6.0.4 and earlier and NITORI App for iOS versions 6.0.2 and earlier allow remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...

grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL

An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the same issue can create a NULL pointer...

CVE-2020-14202

WebFOCUS Business Intelligence 8.0 SP6 was prone to XSS via arbitrary URL parameters...

CVE-2020-14202

WebFOCUS Business Intelligence 8.0 SP6 was prone to XSS via arbitrary URL parameters...

CVE-2020-14202: Improper Neutralization of Input During Web Page Generation

WebFOCUS Business Intelligence 8.0 SP6 was prone to XSS via arbitrary URL parameters...

Spoofing

A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host, aka 'Visual Studio Live Share Spoofing Vulnerability'...

Visual Studio Live Share Spoofing Vulnerability

A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host. An attacker who successfully exploited this vulnerability could cause a connected guest's computer to open a browser and...

CVE-2019-10463: Incorrect Default Permissions

A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

CVE-2019-10442: Missing Authorization

A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...

Cross-Site Scripting (XSS) in script src

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Cross Site Scripting XSS allows clients to inject scripts into a request and have th...

Open Redirection

HTTPie is vulnerable to open redirection. An attacker is able to redirect a request to an arbitrary URL due to the way an output filename is generated when --download without --output results in a redirect...