CVE-2020-29596

MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service daemon crash via a long name for the first parameter in a POST request...

In the urllib3 library through 1.24.1 for Python CRLF injection is possible if the attacker controls the request parameter.

...

CVE-2020-24188: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the search functionality in Intrexx before 9.4.0 allows remote attackers to inject arbitrary web script or HTML via the request parameter...

CVE-2020-15143

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter,...

PT-2020-14223

Name of the Vulnerable Software and Affected Versions SyliusResourceBundle versions prior to 1.3.14 SyliusResourceBundle versions 1.4.0 through 1.4.6 SyliusResourceBundle versions 1.5.0 through 1.5.1 SyliusResourceBundle versions 1.6.0 through 1.6.3 Description The issue arises from request...

PT-2020-14891

Name of the Vulnerable Software and Affected Versions Extreme Management Center versions prior to 8.5.0.169 Description The issue allows unauthenticated reflected XSS via a parameter in a GET request. Recommendations For versions prior to 8.5.0.169, update to version 8.5.0.169 or later to resolve...

Authentication Bypass

Apache Shiro-web is vulnerable to authentication bypass. Lack of proper handling of servletPath parameter in the request allows an attacker to inject malicious string via the request parameter and bypass authentication...

CVE-2020-7262 Improper Access Control vulnerability in ATD

Improper Access Control vulnerability in McAfee Advanced Threat Defense ATD prior to 4.10.0 allows local users to view sensitive files via a carefully crafted HTTP request parameter...

PT-2020-19508

Name of the Vulnerable Software and Affected Versions McAfee Advanced Threat Defense ATD versions prior to 4.10.0 Description The issue is related to improper access control, allowing local users to view sensitive files by crafting a specific HTTP request parameter. Recommendations For versions...

CVE-2020-7262: Exposure of Sensitive Information to an Unauthorized Actor

Improper Access Control vulnerability in McAfee Advanced Threat Defense ATD prior to 4.10.0 allows local users to view sensitive files via a carefully crafted HTTP request parameter...

HPE IMC ForwardRedirect Expression Language Injection

An Expression Language injection vulnerability exists in HPE Intelligent Management Center. This vulnerability is due to insufficient handling of the actionbean request parameter provided to the forwardredirect.xhtml endpoint...

CVE-2019-4446: Undefined Security Weakness

IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID: 163490...

CVE-2020-8427

In Unitrends Backup before 10.4.1, an HTTP request parameter was not properly sanitized, allowing for SQL injection that resulted in an authentication bypass...

CVE-2020-8427: Improper Neutralization of Special Elements used in an SQL Command

In Unitrends Backup before 10.4.1, an HTTP request parameter was not properly sanitized, allowing for SQL injection that resulted in an authentication bypass...

CVE-2019-19838

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/cmdstat.jsp via the uploadFile attribute...

python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter...

CVE-2019-0189

The CVE-2019-0189 issue affects Apache OFBiz via two dependencies (commons-beanutils and an outdated commons-fileupload). It uses Java deserialization in the HttpEngine: the request parameter serviceContext is passed to XmlSerializer.deserialize, enabling remote code execution through java.io.Obj...

Vera Edge Home Controller Command Execution Vulnerability

Vera Edge Home Controller is a smart home central control unit. A security vulnerability exists in LuaUPnP in Vera Edge Home Controller version 1.7.4452. A remote attacker can exploit the vulnerability by sending the 'code' parameter to /port3480/datarequest to execute arbitrary operating system...

PT-2019-8631 · D Link · D-Link Dcs-1130

Name of the Vulnerable Software and Affected Versions: D-Link DCS-1130 devices affected versions not specified Description: An issue was discovered on D-Link DCS-1130 devices, where the device provides a user with the capability of setting a SMB folder for the video clippings recorded by the...

CVE-2017-9392

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port3480". It seems that the UPnP services provide "requestimage" as one of the service actions for ...