74 matches found
SUSE CVE-2018-16745
An issue was discovered in mgetty before 1.2.1. In faxnotifymail in faxrec.c, the mailto parameter is not sanitized. It could allow a buffer overflow if long untrusted input can reach it...
Expense Management System SQL注入漏洞
Expense Management System is an expense management system by Carlo Montero Personal Developer. SourceCodester Expense Management System suffers from a SQL injection vulnerability that originates in the report.php component where the POST parameter handler of the fetchreportcredit function operate...
CVE-2021-25033
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue...
Github Clearance 输入验证错误漏洞
Github Clearance is using email and password for Rails authentication. An input validation error vulnerability exists in clearance, which stems from the fact that if the value used for returnto contains multiple leading slashes //////example.com, the user ends up being redirected to an external...
CVE-2019-20896
WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter...
PT-2019-5693 · Apache +3 · Mod Auth Mellon +4
Name of the Vulnerable Software and Affected Versions: mod auth mellon versions 0.14.2 and earlier Description: The issue is related to an Open Redirect via the login?ReturnTo= substring. This can be exploited by omitting the // after http: in the target URL, allowing a remote attacker to redirec...
PT-2018-1575 · Mgetty +2 · Mgetty +2
Name of the Vulnerable Software and Affected Versions: mgetty versions prior to 1.2.1 Description: An issue in the fax notify mail function in faxrec.c allows for a buffer overflow due to the mail to parameter not being sanitized. This could potentially lead to a denial of service if long untrust...
CVE-2017-17780
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication -...
UBUNTU-CVE-2013-4573
Cross-site scripting XSS vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the "to" parameter to index.php...
rubygem-mail: directory traversal
Directory traversal vulnerability in lib/mail/network/deliverymethods/filedelivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. dot dot in the to parameter...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in TransWARE Active! mail 2003 build 2003.0139.0871 and earlier, and possibly other versions before 2003.0139.0939, allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, 3 Cc, and 4 Bcc parameters...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 inviteemail parameter in an invite action to wp-admin/users.php and the 2 to parameter in a sent action to wp-admin/invites.php...