Yodobashi App for Android fails to restrict access permissions

Overview Yodobashi App for Android provided by Yodobashi Camera Co.,Ltd. implements the function to access a requested URL using an Intent. This function contains an improper access control vulnerability CWE-284 that may allow the vulnerable App to receive an Intent from an arbitrary App and to...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-50965)

Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. Ignite Realtime Openfire 4.5.1 suffers from a stored cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary malicious URLs...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-50966)

Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A cross-site scripting vulnerability exists in Ignite Realtime Openfire 4.5.1, which can be exploited by an attacker via the "searchName", "searchValue", " searchDescription",...

CVE-2020-24601

In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias" in the import certificate trusted page...

CVE-2020-5623

NITORI App for Android versions 6.0.4 and earlier and NITORI App for iOS versions 6.0.2 and earlier allow remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...

grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL

An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the same issue can create a NULL pointer...

CVE-2020-14202

WebFOCUS Business Intelligence 8.0 SP6 was prone to XSS via arbitrary URL parameters...

CVE-2020-14202

WebFOCUS Business Intelligence 8.0 SP6 was prone to XSS via arbitrary URL parameters...

Spoofing

A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host, aka 'Visual Studio Live Share Spoofing Vulnerability'...

Visual Studio Live Share Spoofing Vulnerability

A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host. An attacker who successfully exploited this vulnerability could cause a connected guest's computer to open a browser and...

Cross-Site Scripting (XSS) in script src

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Cross Site Scripting XSS allows clients to inject scripts into a request and have th...

Open Redirection

HTTPie is vulnerable to open redirection. An attacker is able to redirect a request to an arbitrary URL due to the way an output filename is generated when --download without --output results in a redirect...

PT-2019-18668 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana versions prior to 6.8.2 Kibana versions prior to 7.2.1 Description: The issue is related to a server side request forgery SSRF flaw in the graphite integration for the Timelion visualizer. An attacker with administrative access could s...

Mobatek MobaXterm v11.1 - Code Execution Vulnerability

Document Title: =============== Mobatek MobaXterm v11.1 - Code Execution Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2186 Video: https://www.youtube.com/watch?v=Oz0rCBuRKrY Refernces:...

CREATE SD official App for Android fails to restrict access permissions

Overview CREATE SD official App for Android provided by CREATE SD CO., LTD. implements the function to access a requested URL using an Intent. This function contains an improper access control vulnerability CWE-284 that may allow the vulnerable App to receive an Intent from an arbitrary App and t...

Open Redirect in extension "Hairu" (hairu)

The extension fails to validate user input for the parameter “redirecturl”, which allows a redirect to an arbitrary URL after a successful user login...

DEBIAN-CVE-2019-7329

Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, as the form action on multiple views utilizes $SERVER'PHPSELF' insecurely, mishandling any arbitrary input appended to the webroot URL, without any proper filtration, leading to XSS...

U.S. Dept Of Defense: SSRF on ████████

Summary: The web application hosted on the "███████" domain is affected by a Server Side Request Forgery SSRF vulnerability that could allows an attacker to force the application to make requests to arbitrary targets. Description: The affected handler is the "/xmlrpc/pingback/". This handler...

Security Bulletin: Arbitrary URL Redirection (CVE-2018-1704) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Arbitrary URL Redirection CVE-2018-1704 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1704 DESCRIPTION: IBM Platform Symphony could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to...

TripAdvisor Browsable Intent Arbitrary URL Loading Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on vulnerable installations of TripAdvisor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of browsab...