4603 matches found
Cross-site Scripting (XSS)
nystudio107/craft-seomatic is vulnerable to cross-site scripting. The vulnerability exists because the actionSeoFileLink function of FileController.php does not properly check the file types, allowing an attacker to inject and execute malicious javascript by submitting a GET request to...
Cross-site Scripting in SEOmatic plugin
A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...
CVE-2021-41750
A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...
CVE-2021-41750
A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...
PT-2026-34853
Name of the Vulnerable Software and Affected Versions Delta Electronics AS320T affected versions not specified Description The web service contains an incorrect calculation of the buffer size on the stack within the GET/PUT request handler. This occurs when processing requests, which can lead to...
Information Disclosure
phoenixws is vulnerable to information disclosure, the vulnerability exists due to a lack of sanitization of HTTP GET request, allowing an attacker to access source code, files, and folders in phoenixfiles/extensions...
Siemens SICAM P850/P855 XSS
The vulnerability of Siemens SICAM P850 and Siemens SICAM P855 multifunctional measuring devices lies in insufficient cleaning of user data in the GET request parameter. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks using a specially created link...
Phoenix-ws source code and data in extensions folder is publicly available
Impact All of the source code, files, and folders in phoenixfiles/extensions/ are available to end users through a simple HTTP GET request. Patches The issue has been patched. The users of version 1.0.6 and above are not effected...
GHSA-C8F7-X2G7-7FXJ Phoenix-ws source code and data in extensions folder is publicly available
Impact All of the source code, files, and folders in phoenixfiles/extensions/ are available to end users through a simple HTTP GET request. Patches The issue has been patched. The users of version 1.0.6 and above are not effected...
CVE-2022-24414: Use of GET Request Method With Sensitive Query Strings
Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attac...
GHSA-VCFC-9WCP-J623 Cross site scripting attack in ServiceStack Framework
ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting XSS. The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side...
ThinkAdmin directory traversal vulnerability
ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter...
GHSA-2QM5-R82G-5HCX ThinkAdmin directory traversal vulnerability
ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter...
GHSA-C4WX-3X5Q-HF4W Subrion CMS Cross-Site Request Forgery (CSRF) vulnerability
A Cross-Site Request Forgery CSRF vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a G...
GHSA-8P5C-F836-M4H7 Magento 2 Community Edition XML Injection
An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data...
Magento 2 Community Edition XML Injection
An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data...
GHSA-P9VF-4JX2-5HPP Magento 2 Community Edition Security Bypass
A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email confirmation mechanism via GET request that captures relevant account data obtained from the POST response related to new user creation...
Magento 2 Community Edition Security Bypass
A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email confirmation mechanism via GET request that captures relevant account data obtained from the POST response related to new user creation...
CVE-2019-3995
ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. A remote unauthenticated attacker can crash the ELOG server by sending a crafted HTTP GET request...