F5 BIG-IQ 跨站脚本漏洞

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing from F5 USA. A cross-site scripting vulnerability exists in BIG-IQ, which could be exploited by an attacker using a specially crafted URL to reflect...

CVE-2020-5016

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. When application security is disabled and JAX-RPC applications are present, an attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to vi...

CVE-2021-20668

Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL...

Weseek GROWI 路径遍历漏洞

GROWI is a team collaboration software. A path traversal vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited to read arbitrary paths via a specially crafted URL...

GHSA-C4QR-GMR9-V23W Prefix escape

Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...

Prefix escape

Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...

fastify-http-proxy 输入验证错误漏洞

Docs fastify-http-proxy is Docs an open source application . It is used to forward all incoming requests with a given prefix or no prefix to the upstream. A security vulnerability exists in fastify-http-proxy that stems from the ability to escape the prefix of a proxy backend service by creating ...

CVE-2021-20354

IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 194883...

CVE-2020-7849

A vulnerability of uPrism.io CURIXVideo conferecing solution could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient inputserver domain validation. An attacker could exploit this vulnerability through crafted URL...

CVE-2020-7849

A vulnerability of uPrism.io CURIXVideo conferecing solution could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient inputserver domain validation. An attacker could exploit this vulnerability through crafted URL...

Code injection

A vulnerability of uPrism.io CURIXVideo conferecing solution could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient inputserver domain validation. An attacker could exploit this vulnerability through crafted URL...

CVE-2020-7849

CVE-2020-7849 affects uPrism.io CURIX (Video conferencing): an unauthenticated attacker could trigger remote arbitrary code execution due to insufficient input validation of the server domain via crafted URLs. The vulnerability arises from improper input validation in the URL handling path. Explo...

CVE-2021-27229

Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text...

Remote code execution

Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text...

CVE-2021-27229

Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text...

CVE-2021-27229

Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text...

CVE-2021-27229

Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text...

CVE-2021-27229

Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text...

CVE-2021-20637

Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/PR5B allows a remote attacker to cause a denial-of-service DoS condition by sending a specially crafted URL...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted...