3910 matches found
Archer Platform 安全漏洞
Archer Platform is a modern integrated risk management solution from Archer, Inc. A security vulnerability exists in versions of Archer Platform prior to 6.13 that stems from a vulnerability that allows an authenticated attacker to obtain sensitive information via a crafted URL...
The vulnerability of the access control system for the virtual environment, previously known as Citrix Secure Access (formerly Citrix Gateway), is related to improper code generation. This allows a malicious individual to execute arbitrary code.
The vulnerability of the access control system for the virtual environment, previously known as Citrix Secure Access formerly Citrix Gateway, is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by having the user navigate to a...
CVE-2021-42080
An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://:8153/qstorapi/echo?inputMessage=...
CVE-2021-42080
An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://:8153/qstorapi/echo?inputMessage=...
Cross site scripting
An attacker is able to launch a Reflected XSS attack using a crafted URL...
CVE-2021-42080 Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355
An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://:8153/qstorapi/echo?inputMessage=...
CVE-2021-42080
Affected software : OSNEXUS QuantaStor (before 6.0.0.355). Vulnerability : CVE-2021-42080 – Reflected XSS via a crafted URL in the QuantaStor web interface (qstorapi/echo?inputMessage). Root cause : improper handling/encoding of user-supplied input reflected in the response. Impact : potential to...
CVE-2021-42080 Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355
An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://:8153/qstorapi/echo?inputMessage=...
CVE-2023-3139 Protect WP Admin < 4.0 - Unauthenticated Protection Bypass
The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered...
PT-2023-8183 · Zyxel · Zyxel Nas326 +1
Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 firmware version V5.21AAZF.14C0 Zyxel NAS542 firmware version V5.21ABAG.11C0 Description: The issue is related to the improper neutralization of special elements in the CGI program of the Zyxel NAS326 and NAS542 firmware. This...
MGASA-2023-0211 Updated python-tornado packages fix security vulnerability
Remote unauthenticated attacker may redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. CVE-2023-28370...
Cross site request forgery (csrf)
Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery CSRF in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL...
CVE-2023-33289
The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service ReDos via a crafted URL to lib.rs. NOTE: the Supplier disputes this, taking the position that "Slow printing of URLs is not a CVE."...
CVE-2023-33289
The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service ReDos via a crafted URL to lib.rs. NOTE: the Supplier disputes this, taking the position that "Slow printing of URLs is not a CVE."...
Server-Side Request Forgery
matrix-synapse is vulnerable to Server-Side Request Forgery. The vulnerability exists in the preview function in urlpreviewer.py because it doesn't properly validate blacklist urls, which allows a remote attacker to cause an SSRF bypass via a crafted url...
CVE-2023-29304
Adobe Experience Manager versions 6.5.16.0 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...
USN-6159-1: Tornado vulnerability
It was discovered that Tornado incorrectly handled certain redirect. An remote attacker could possibly use this issue to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL...
Okta Advanced Server Access Client < 1.58.0 Command Injection
The versions of Okta Advanced Server Access Client installed on the remote host is affected by a command injection vulnerability via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execut...
PT-2023-24272 · Unknown · Giturlparse
Name of the Vulnerable Software and Affected Versions: git-url-parse versions 0.4.4 and earlier Description: The issue allows Regular Expression Denial of Service ReDos via a crafted URL to normalize url in lib.rs. This is similar to an issue found in Python. Recommendations: For versions 0.4.4 a...