CVE-2022-42139

Delta Electronics DVW-W02W2-E2 1.5.0.10 is vulnerable to Command Injection via Crafted URL...

The vulnerability of the FortiIsolator browser isolation platform, related to inadequate access control, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the FortiIsolator browser isolation platform is related to deficiencies in access control. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to protected information by generating a certificate again through a specially created URL address...

Cross site scripting

A cross-site scripting XSS vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an...

CVE-2022-40603

A cross-site scripting XSS vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an...

Cross site scripting

A cross-site scripting XSS vulnerability in ClicShoppingV3 v3.402 allows attackers to execute arbitrary web scripts or HTML via a crafted URL parameter...

ClicShopping 跨站脚本漏洞

ClicShopping is an e-commerce open source solution from ClicShopping Open Source. A security vulnerability exists in ClicShopping version v3.402, which originates from Cross-Site Scripting XSS and allows an attacker to execute arbitrary Web script or HTML via crafted URL parameters...

CVE-2022-45769

A cross-site scripting XSS vulnerability in ClicShoppingV3 v3.402 allows attackers to execute arbitrary web scripts or HTML via a crafted URL parameter...

Exploit for CVE-2022-25765

CVE-2022-25765-pdfkit-Exploit-Reverse-Shell pdfkit 0.8.6 c...

Server-Side Request Forgery (SSRF)

github.com/kubevela/kubevela is vulnerable to server-side request forgery. The vulnerability is due to common.go because the request address in the warehouse is not properly restricted which allows an attacker to cause a SSRF bypass via a crafted url...

kkFileView 代码问题漏洞

Keking kkFileView is China's Keking Technology Keking company's Spring-Boot to build a file document online preview project . A security vulnerability exists in kkFileView v4.1.0, which stems from the component cn.keking.web.controller.OnlinePreviewControllergetCorsFile containing server-side...

CVE-2022-23738

An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private repository files through a public repository. To exploit this, an actor would need to already be authorized on the GitHub Enterprise Server instance, be able to crea...

Security Bulletin: TRIRIGA Application Platform Authorization Bypass Vulnerability (CVE-2014-8895)

Abstract IBM TRIRIGA Application Platform could allow a remote attacker to view image files uploaded by other users through the use of a specially crafted URL. Content Vulnerability Details CVEID:CVE-2014-8895 CVSS Base Score: 4.30 CVSS Temporal Score: See...

CVE-2022-38439

Adobe Experience Manager versions 6.5.13.0 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's...

CVE-2022-38512

The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL...

CVE-2022-23685

A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a lack of Cross-Site Request Forgery CSRF protection. This could allow a remote unauthenticated attacker to execute arbitrary input against these endpoints if the attacker can...

CVE-2022-30684

Adobe Experience Manager versions 6.5.13.0 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's...

CVE-2022-30685

Adobe Experience Manager versions 6.5.13.0 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's...

Server-Side Request Forgery (SSRF)

parse-url is vulnerable to server-side request forgery. The vulnerability exists in the parseUrl function in index.js because it doesn't validate url or detect the protocol, resource, pathname and user param properly which allows an attacker to cause an ssrf bypass via a crafted url...

CVE-2022-31735

OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability CWE-601. When accessing an affected server through some specially crafted URL, the user may be redirected to an arbitrary website...

CVE-2022-31735

OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability CWE-601. When accessing an affected server through some specially crafted URL, the user may be redirected to an arbitrary website...