CVE-2016-2881

IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 and QRadar Incident Forensics 7.2 before 7.2.7 allow remote attackers to bypass intended access restrictions via modified request parameters...

IBM QRadar SIEM and Incident Forensics Security Bypass Vulnerability

IBM Security QRadar Incident Forensics is a suite of security forensic investigation software from IBM USA. The software supports in-depth forensic investigations of suspected malicious cybersecurity incidents and the remediation of cybersecurity vulnerabilities.IBM QRadar SIEM is an IBM solution...

The vulnerability of the Adobe Connect instant messaging program allows a hacker to inject arbitrary Web or HTML code.

The vulnerability of the Adobe Connect instant messaging program exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using request parameters...

IBM Lotus Domino Web Server iNotes Buffer Overflow (CVE-2003-0178)

A buffer overflow vulnerability exists in IBM Lotus Domino iNotes Web Server. The vulnerability is due to incorrect handling of client-supplied request parameters. A remote attacker can exploit this vulnerability by sending crafted requests to affected servers...

CVE-2015-4297

Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server MCS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted HTTP request parameters, aka Bug ID CSCuv32136...

Open redirect

Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server MCS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted HTTP request parameters, aka Bug ID CSCuv32136...

CVE-2015-4297

Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server MCS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted HTTP request parameters, aka Bug ID CSCuv32136...

PhpMyAdmin SERVER Superglobal Remote Variable Manipulation

A remote variable manipulation vulnerability has been reported in PhpMyAdmin. The vulnerability is due to insufficient validation of request parameters. A remote attacker could exploit this vulnerability by sending a malicious request to the server. Successful exploitation could result in...

PhpMyAdmin GLOBALS Superglobal Remote Variable Manipulation

A remote variable manipulation vulnerability has been reported in PhpMyAdmin. The vulnerability is due to insufficient validation of request parameters. A remote attacker could exploit this vulnerability by sending a malicious request to the server. Successful exploitation could result in...

PhpMyAdmin ENV Superglobal Remote Variable Manipulation (CVE-2010-3065)

A remote variable manipulation vulnerability has been reported in PhpMyAdmin. The vulnerability is due to insufficient validation of request parameters. A remote attacker could exploit this vulnerability by sending a malicious request to the server. Successful exploitation could result in...

CVE-2014-0058

The security audit functionality in Red Hat JBoss Enterprise Application Platform EAP 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files...

Oracle BPEL Process Manager ScriptServlet Information Disclosure (CVE-2013-3828)

A directory traversal vulnerability has been reported in Oracle BPEL Process Manager. The vulnerability is due to insufficient input validation in ScriptServlet when processing HTTP request parameters. A remote unauthenticated attacker can leverage this vulnerability to obtain sensitive informati...

HP Intelligent Management Center BIMS bimsDownload Information Disclosure (CVE-2013-4823)

An information disclosure vulnerability has been reported in the BIMS add-in module of HP Intelligent Management Center.The vulnerability is due to lack of authentication and insufficient input validation in the bimsDownload servlet when processing HTTP request parameters. Remote attackers can...

struts 2.3.14 includeParams 命令执行漏洞

Apache Struts框架是一个基于Java Servlets,JavaBeans和JavaServer PagesJSP的Web应用框架的开源项目,Struts基于Model-View-ControllerMVC的设计模式,可以用来构件复杂的Web应用.Apache Struts 2.3.14标签库中的url标签和a标签的includeParams这个属性，代表显示请求访问参数的含义，一旦它的值被赋予ALL或者GET或者POST，就会显示具体请求参数内容。可利用此进行命令执行攻击 struts 2.3.14...

HP Intelligent Management Center ReportImgServlet Information Disclosure (CVE-2012-5203)

An information disclosure vulnerability has been reported in HP Intelligent Management Center. The vulnerability is due to lack of authentication and insufficient input validation in the ReportImgServlet servlet when processing HTTP request parameters. By sending crafted HTTP requests to the targ...

Reflected xss in CloneSessionPost.jspa

In plugin/src/main/resources/templates/excalibur/web/testsessions/test-session-clone.vm on line 2, the 'testSessionId' parameter is extracted from the request parameters and inserted without first html encoding the value into the form element 'action' value. This means means that the resource is...

CVE-2009-5031

ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting XSS attacks via a single quote in a request parameter in the Content-Disposition field of a...

tomcat RequestDispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. d...

Citrix Access Gateway information leak

HTTP session cookie is passed through HTTP GET request parameters, making it possible to leak it value thorugh Referer: field or in the browsing history...

CVE-2007-1605

w-Agora Web-Agora allows remote attackers to obtain sensitive information via a request to rss.php with an invalid 1 site or 2 bn parameter, 3 a certain value of the site parameter, or 4 an empty value of the bn parameter; a request to index.php with a certain value of the 5 site or 6 sort...