CVE-2026-1698: Improper Neutralization of HTTP Headers for Scripting Syntax

A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior. This vulnerability only affects the endpoints...

EUVD-2020-18802

Malware in sbrugna...

Grafana Visualization Plugin Server Request Manipulation Unauthorized Access

The vulnerability of the Infinity Datasource plugin for the Grafana monitoring and observation platform relates to server-side request manipulation. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

Server side request forgery (ssrf)

A Server-Side Request Forgery SSRF in loonflow r2.0.14 allows attackers to force the application to make arbitrary requests via manipulation of the hookurl parameter...

ManageJiraConnectors API Disclosure Protected Information

The vulnerability of the ManageJiraConnectors API interface of the cloud-based corporate solution for planning and managing software and IT projects like Jira Align formerly AgileCraft involves server-side request manipulation. Exploiting this vulnerability allows a malicious actor to disclose...

Red Hat Advanced Cluster Privilege Escalation

The vulnerability of the Red Hat Advanced Cluster Security RHACS control and container management tool for Kubernetes is related to server-side manipulation of requests. Exploiting this vulnerability can allow attackers to enhance their privileges and gain unauthorized access to protected...

Adobe Experience Manager Unauthorized Access

The vulnerability of the Adobe Experience Manager content and media data management system is caused by server-side manipulation of requests. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP network protoc...

CVE-2020-26177

In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibit...

XWork 2.0.11.2 - ParameterInterceptor Class OGNL Security Bypass

XWork 2.0.11.2 - ParameterInterceptor Class OGNL Security Bypass source: https://www.securityfocus.com/bid/32101/info XWork is prone to a security-bypass vulnerability because it fails to adequately handle user-supplied input. Attackers can exploit this issue to manipulate server-side context...