918 matches found
CVE-2022-30992
CVE-2022-30992 affects Acronis Cyber Protect 15 (Linux/Windows) before build 29240, with an input validation/open redirect vulnerability via a user-controlled query parameter. Root cause cited as input validation error; impact is open redirect. Connected sources (CNVD/CNNVD/NVD) confirm the affec...
ImpressCMS Cross-site scripting Vulnerability
A cross-site scripting XSS vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a listimg action...
GHSA-6C8C-F2W2-JVJR Alkacon OpenCMS XSS via homelink, workplaceresource, mode and query parameters
Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...
GHSA-RC94-7V55-WMG6 Subrion CMS CSRF Vulnerability
There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...
Subrion CMS CSRF Vulnerability
There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...
Improper Input Validation in Apache Hadoop
HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0...
CVE-2022-28077
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting XSS vulnerability in the Admin panel via the $GET's' parameter...
CVE-2022-27183
The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platfo...
Alkacon OpenCms XSS via query parameter in a search action
Cross-site scripting XSS vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action...
CVE-2022-29810
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter...
Design/Logic Flaw
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter...
CVE-2022-29810
CVE-2022-29810 affects the HashiCorp go-getter library, where versions before 1.5.11 fail to redact an SSH private key in a URL query parameter. In practice, this can lead to exposure of SSH credentials in logs or error messages, potentially readable by local users with access to the logfile. Con...
Cross-site Scripting (XSS)
Overview whoogle-search is a Self-hosted, ad-free, privacy-respecting metasearch engine Affected versions of this package are vulnerable to Cross-site Scripting XSS via the query string parameter q. In the case where it does not contain the http string, it is used to build the errormessage that i...
Exrick XMall 跨站脚本漏洞
Exrick XMall is a distributed e-commerce shopping mall based on SOA architecture. A security vulnerability exists in the Exrick XMall Admin Panel, which originates from a GET parameter in product-add.jsp...
Subrion CMS 跨站脚本漏洞
Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into websites and supports multiple extension plugins, etc. A security vulnerability exists in Subrion CMS 4.2.1, which can be exploited by attackers via the q parameter in the Kickstart...
The vulnerability of the downloadLogFiles function in the industrial food industry management server application AK-EM 800 allows a hacker to execute arbitrary SQL queries.
The vulnerability of the downloadLogFiles function in the industrial food industry management server application AK-EM 800 relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries through the...
PT-2022-8590
Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1 Description A Cross Site Scripting XSS issue exists via the q parameter in the Kickstart template, allowing for potential malicious script execution. Recommendations For Subrion CMS version 4.2.1, consider disabling t...
Jenkins GitLab Authentication Plugin User Redirection Vulnerability
Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A user redirection vulnerability exists in Jenkins GitLab Authentication Plugin 1.13 and earlier versions, which stems fr...
