CVE-2020-5008: Insecure Storage of Sensitive Information

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID:...

GHSA-8P36-Q63G-68QH Autobinding vulnerability in MITREid Connect

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment aka Autobinding vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in...

Autobinding vulnerability in MITREid Connect

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment aka Autobinding vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in...

McAfee Advanced Threat Defense Information Disclosure Vulnerability (CNVD-2021-43545)

McAfee Advanced Threat Defense ATD is a set of threat detection and defense solutions from the U.S. company McAfee McAfee, providing malware analysis, sharing threat intelligence and isolating compromised systems. An information disclosure vulnerability exists in the web interface of McAfee...

D-link DIR-816 A2 Remote Code Injection Vulnerability

The D-link DIR-816 A2 is a wireless AC750 dual-band router. A remote code injection vulnerability exists in the D-link DIR-816. The vulnerability stems from the availability of HTTP request parameters in the command string construction in the handler function of /goform/dirsetWanWifi. The...

Authorization

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment aka Autobinding vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in...

YCCMS path traversal vulnerability

YCCMS is a Php-based lightweight CMS builder from the Yccms team. YCCMS 3.3 has a path traversal vulnerability, which stems from an error in the judgment of request parameters by the delete, deletesite, and deleteAll functions. No detailed vulnerability details are available...

CVE-2020-20290

Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability...

CVE-2020-20289

Sql injection vulnerability in the yccms 3.3 project. The notop function's improper judgment of the request parameters, triggers a sql injection vulnerability...

Sql injection

Sql injection vulnerability in the yccms 3.3 project. The notop function's improper judgment of the request parameters, triggers a sql injection vulnerability...

CVE-2020-20289

Sql injection vulnerability in the yccms 3.3 project. The notop function's improper judgment of the request parameters, triggers a sql injection vulnerability...

CVE-2020-20289: Improper Neutralization of Special Elements used in an SQL Command

Sql injection vulnerability in the yccms 3.3 project. The notop function's improper judgment of the request parameters, triggers a sql injection vulnerability...

CVE-2021-22847 Hyweb HyCMS-J1 - SQL Injection

Hyweb HyCMS-J1's API fail to filter POST request parameters. Remote attackers can inject SQL syntax and execute commands without privilege...

PHP-Fusion downloads.php Privilege Escalation (CVE-2020-24949)

A privilege escalation vulnerability exists in PHP-Fusion. The vulnerability is due to insufficient validation of HTTP request parameters in downloads.php...

United Planet Intrexx Professional Cross-Site Scripting Vulnerability

United Planet Intrexx Professional is an integrated cross-platform development environment from United Planet Germany. It enables the creation of Web-based applications, enterprise portals, intranet portals and more. A cross-site scripting vulnerability exists in United Planet Intrexx Professiona...

Input validation

Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive information etc...

CVE-2020-25761: Improper Neutralization of Input During Web Page Generation

Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive information etc...

Sylius Injection Vulnerability (CNVD-2020-49008)

Sylius is a Polish company Sylius set of open source e-commerce platform based on the Symfony framework . An injection vulnerability exists in Sylius ResourceBundle, which stems from the program's failure to properly handle request parameters. An attacker can exploit the vulnerability to execute...

Sylius Injection Vulnerability

Sylius is a Polish company Sylius set of open source e-commerce platform based on the Symfony framework . An injection vulnerability exists in Sylius ResourceBundle, which stems from the program's failure to properly handle request parameters. An attacker can exploit the vulnerability to execute...

CVE-2020-15143: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter,...