86 matches found
CVE-2022-27090
Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter...
CScms 输入验证错误漏洞
CScms is a content management system CMS developed on a CI framework. A security vulnerability exists in CScms Music Portal System v4.2, which stems from a backurl parameter that causes a redirect. No details of the vulnerability are available at this time...
CVE-2022-27090: URL Redirection to Untrusted Site
Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter...
CVE-2022-25256
SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfsrequestbacklabellist and saspfsrequestbackurllist. The first one affects the content of the button placed in the top left. The second affects the page to which the user is directed after pressing...
Sas Institute Sas Web Report Studio 跨站脚本漏洞
Sas Institute Sas Web Report Studio is a web application from Sas Institute, Inc. It is used to view, interact with, create, and distribute public and private reports. A cross-site scripting vulnerability exists in Sas Institute Sas Web Report Studio, which stems from Do having two parameters:...
CVE-2020-20982
Cross Site Scripting XSS vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl parameter to /php/passport/index.php...
CVE-2020-20982
Cross Site Scripting XSS vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl parameter to /php/passport/index.php...
Cross site scripting
Cross Site Scripting XSS vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl parameter to /php/passport/index.php...
shadow 跨站脚本漏洞
shadow is a suite of tools for maintaining Debian systems. A cross-site scripting vulnerability exists in shadow web wdja, which stems from the product's /php/passport/index.php file failing to properly handle data in the backurl parameter. An attacker could use this vulnerability to execute...
CVE-2020-20982: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl parameter to /php/passport/index.php...
U.S. Dept Of Defense: DOM Based XSS on https://████ via backURL param
Description: The following endpoint suffers from DOM Based XSS https://████████/██████=javascript:alertdocument.domain The ████████ param determines the content which will be displayed on the "Back to Search Result" button, eventually leading to RXSS. References ██████ Regards nagli Impact...
Mail.ru: [account.mail.ru] XSS на странице удаления аккаунта через backUrl
Недостаточная валидация параметра backUrl даёт возможность указать javascript-ссылку: https://account.mail.ru/user/delete?backUrl=javascript:alertdocument.domain javascript getBackUrl: function url return /^http/.testurl ? url : this.urlData.backUrl || this.config.get'backUrl' ||...
SS-2016-016: XSS In CMSSecurity BackURL
More info at https://www.silverstripe.org/download/security-releases/ss-2016-016/...
IBM Cognos Business Intelligence Tivoli Common Reporting Security Bypass Vulnerability
IBM Cognos Business Intelligence BI and IBM Tivoli Common Reporting TCR are both products of IBM Corporation, U.S.A. BI is a set of business intelligence software. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such...
Design/Logic Flaw
IBM Tivoli Common Reporting TCR 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and 3.1.2.1 as used in Cognos Business Intelligence before 10.2.1.1 IF12 allows local users to bypass the Cognos Application...
CVE-2015-7435
IBM Tivoli Common Reporting TCR 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and 3.1.2.1 as used in Cognos Business Intelligence before 10.2.1.1 IF12 allows local users to bypass the Cognos Application...
IBM Cognos Business Intelligence Developer 10.2.1 Open Redirect
IBM Cognos Business Intelligence Developer 10.2.1 backURL Open Redirect Vendor: IBM Corporation Product web page: http://www.ibm.com Affected version: 10.2.1 Build 10.2.5000.267 Trial Summary: IBM Cognos Business Intelligence is a web-based, integrated business intelligence suite by IBM. It...
Oracle Identity Manager (October 2014 CPU
The remote host is missing the October 2014 Critical Patch Update for Oracle Identity Manager. It is, therefore, affected by multiple vulnerabilities : - The application is affected by a vulnerability in Apache Commons BeanUtils in which ClassLoader objects can be set via the class attribute of a...
SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure
source: https://www.securityfocus.com/bid/61578/info SilverStripe is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. SilverStripe 3.0.3 is vulnerable; other versions may also be affected...