CVE-2023-50328: Use of GET Request Method With Sensitive Query Strings

IBM PowerSC 1.3, 2.0, and 2.1 may allow a remote attacker to view session identifiers passed via URL query strings. IBM X-Force ID: 275110...

IBM PowerSC 安全漏洞

IBM PowerSC is an International Business Machines IBM security and compliance solution for IBM Power Systems servers. An information disclosure vulnerability exists in IBM PowerSC, which can be exploited by an attacker to view session identifiers passed via URL query strings...

The vulnerability of the software for managing access to the Omniverse platform, specifically NVIDIA Omniverse Workstation Launcher, relates to the ability to disclose information through query strings, allowing an intruder to gain unauthorized access to protected information.

The vulnerability of the NVIDIA Omniverse Workstation Launcher software relates to the disclosure of information through query strings. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the FortiOS operating system, related to the exposure of information through query strings, allows attackers to view open text passwords of deleted services such as RDP or VNC.

The vulnerability of the FortiOS operating system’s request method is related to the disclosure of information through the request strings. Exploiting this vulnerability allows a malicious actor to remotely access open text passwords of deleted services, such as RDP or VNC...

Fortinet Fortigate Plain-text credentials in GET request via SSL VPN web portal (FG-IR-23-120)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-120 advisory. - A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 an...

Cross site request forgery (csrf)

A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services...

CVE-2023-37935: Use of GET Request Method With Sensitive Query Strings

A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services...

Apache Tomcat 8.5.85 < 8.5.88 DoS

The version of Tomcat installed on the remote host is prior to 8.5.88. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.5.88security-8 advisory. The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to...

CLSA-2023-1679943745 Fix CVE(s): CVE-2023-25690

SECURITY UPDATE: proxy configuration may trigger HTTP request smuggling attack - debian/patches/CVE-2023-25690.patch: don't forward invalid query strings - CVE-2023-25690...

SQL Injection

sequelize is vulnerable to SQL Injection. The vulnerability exists because the library does not properly escape the query strings in the replacement parameter used in the where clause, allowing an attacker to inject and execute malicious SQL queries...

SUSE CVE-2012-2336

sapi/cgi/cgimain.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script aka php-cgi, does not properly handle query strings that lack an = equals sign character, which allows remote attackers to cause a denial of service resource consumption by placing command-line options...

SUSE CVE-2016-5097

phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading 1 HTTP requests or 2 server logs...

[SECURITY] [DLA 3299-1] node-qs security update

Debian LTS Advisory DLA-3299-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin January 30, 2023 https://wiki.debian.org/LTS Package : node-qs Version : 6.5.2-1+deb10u1 CVE ID : CVE-2022-24999 Nathanael Braun and Johan Brissaud discovered a prototype poisoning...

PT-2022-17038

Name of the Vulnerable Software and Affected Versions qs versions prior to 6.10.3 Express versions prior to 4.17.3 Description The issue allows attackers to cause a Node process hang for an Express application because an proto key can be used. In many typical Express use cases, an unauthenticated...

CVE-2020-15338

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests...

CVE-2020-15337

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests...

CVE-2020-15337

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests...

Cross site request forgery (csrf)

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests...

Cross site request forgery (csrf)

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests...

OpenStack barbican 安全漏洞

OpenStack is a cloud platform management program of the National Aeronautics and Space Administration NASA. barbican is an OpenStack key management service, API server. A security vulnerability exists in OpenStack barbican that stems from an issue in the component that allows access policies to b...