SUSE CVE-2016-3079

Multiple cross-site scripting XSS vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to systems/SystemEntitlements.do; 2 the label parameter to admin/multiorg/EntitlementDetails.do; or the name of a...

CVE-2022-31786

IdeaLMS 2022 allows reflected Cross Site Scripting XSS via the IdeaLMS/Class/Assessment/ PATHINFO...

GHSA-HJ2V-85PH-8G48 Cross-site Scripting in Apache Jetspeed

Cross-site scripting XSS vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to portal...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via crafted PATHINFO in a URL. An attacker can inject arbitrary code by manipulating the unsanitized $SERVER'PHPSELF' used to generate URLs. Details Cross-site scriptin...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the viewfilterspage.php. An attacker can inject arbitrary code by crafting the PATHINFO if CSP settings permit it. Details Cross-site scripting or XSS is a code...

Apache Tomcat Reveals Path through Long URL

Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension...

Directory traversal

Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs. Due to this...

CVE-2020-24701

OX App Suite through 7.10.4 allows XSS via the app loading mechanism the PATHINFO to the /appsuite URI...

DBHcms Information Disclosure Vulnerability

DBHcms is a small, free and open source content management system for personal and small business websites. An information disclosure vulnerability exists in DBHcms 1.2.0. The vulnerability stems from /dbhcms/ext/news/ext.news.be.php has security access control. A remote unauthenticated attacker...

CVE-2020-19878

DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A remote unauthenticated attacker can exploit this vulnerability to get path information...

CVE-2020-19878

DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A remote unauthenticated attacker can exploit this vulnerability to get path information...

Information disclosure

DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A remote unauthenticated attacker can exploit this vulnerability to get path information...

CVE-2020-19878

DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A remote unauthenticated attacker can exploit this vulnerability to get path information...

Open Redirection

firefox is vulnerable to open redirection. When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the address bar...

CVE-2020-12408

When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the address bar. This vulnerability affects Firefox 77...

ERPNext Reflective Cross-Site Scripting Vulnerability

ERPNext is a free, open source, integrated enterprise resource planning software. A reflected cross-site scripting vulnerability exists in ERPNext 11.1.47. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the PATHINFO of the blog/ URI...

ERPNext Reflective Cross-Site Scripting Vulnerability (CNVD-2020-18553)

ERPNext is a free, open source, integrated enterprise resource planning software. A reflected cross-site scripting vulnerability exists in ERPNext 11.1.47. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the PATHINFO of the addresses/ URI...

CVE-2019-20447

Jobberbase 2.0 has SQL injection via the PATHINFO to the jobs-in endpoint...

CVE-2018-16386

An issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection and an arbitrary log filename can be achieved via the PATHINFO to swp/login/EJBRemoteService/, related to com.swift.ejbgwt.j2ee.client.EjBlnvocationException error log information containing null@java:comp/env/ error...

CVE-2019-3576

inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveorite/ PATHINFO. The vulnerable code location is com.inxedu.os.edu.controller.user.UserControllerdeleteFavorite aka deleteFavorite in...