python: CRLF injection via the query part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the query string after a ? charact...

CVE-2018-5757

An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...

CVE-2017-18364

phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter...

CVE-2018-18940

servlet/SnoopServlet a servlet installed by default in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=XSS in the query string. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web...

CVE-2018-18940: Improper Neutralization of Input During Web Page Generation

servlet/SnoopServlet a servlet installed by default in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=XSS in the query string. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web...

CubeCart Cross-Site Scripting Vulnerability

Devellion CubeCart is a free and open source e-commerce shopping cart software from Devellion UK. The software supports selling products in an online store, adding/editing products or images etc. A cross-site scripting vulnerability exists in Devellion CubeCart version 6.2.2. A remote attacker ca...

CVE-2018-20703: Improper Neutralization of Input During Web Page Generation

CubeCart 6.2.2 has Reflected XSS via a /ADMIN-FILE/ query string...

PT-2019-10169

Name of the Vulnerable Software and Affected Versions: CubeCart version 6.2.2 Description: The issue is related to Reflected XSS, which can be exploited via a query string in the ADMIN-FILE endpoint. Recommendations: For CubeCart version 6.2.2, update to a newer version that contains a fix for th...

Cross site scripting

Cross-site scripting in eventscript.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter...

CVE-2018-14481

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

Design/Logic Flaw

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

CVE-2018-14481

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

CVE-2018-14481

OSClass 3.7.4 is affected by CVE-2018-14481: it has Cross-Site Scripting (XSS) via the query string to index.php (notably in the OSClass 3.7.4 release, separate from CVE-2014-6280). Other connected sources describe multiple XSS vulnerabilities in OSClass 3.7.4, including potential reflections and...

PT-2019-9543

Name of the Vulnerable Software and Affected Versions VIVOTEK Network Camera Series products with firmware 0x06x through 0x08x Description The issue concerns cross-site scripting in the event script.js file, allowing remote attackers to execute arbitrary JavaScript code via a URL query string...

PT-2019-9027

Name of the Vulnerable Software and Affected Versions Osclass version 3.7.4 Description The issue is related to a Cross-Site Scripting XSS vulnerability. It occurs via the query string to the "index.php" endpoint. Recommendations For Osclass version 3.7.4, update to a version that includes a fix...

CVE-2018-18005: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in eventscript.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter...

CVE-2018-14481: Improper Neutralization of Input During Web Page Generation

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

CVE-2018-20520

MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233...

PT-2018-15412

MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233...

CVE-2018-20520: Improper Neutralization of Input During Web Page Generation

MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233...