URL Redirection to Untrusted Site (Open Redirect)

The Kubernetes kube-apiserver is vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise...

ArticaTech Artica Proxy SQL Injection Vulnerability

ArticaTech Artica Proxy is an open source Artica proxy solution from the French company ArticaTech. A SQL injection vulnerability exists in ArticaTech Artica Proxy Community Edition versions prior to 4.28.030.418. The vulnerability stems from a lack of validation of externally entered SQL...

Online Polling System Authentication Bypass SQL Injection Vulnerability

Online Polling System is an online voting system. A security vulnerability exists in Online Polling System. The vulnerability stems from a database application that lacks validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute illegal SQL commands...

Glacies IceHRM SQL Injection Vulnerability

Glacies IceHRM is a human resource management system from the Glacies team in Germany. The system includes features such as expense management, recruitment management, payroll management and leave management. A SQL injection vulnerability exists in the Admin Reports feature in Glacies IceHRM...

phpList SQL Injection Vulnerability (CNVD-2020-41812)

phpList is an open source newsletter and email marketing software from phpList UK. A SQL injection vulnerability exists in phpList 3.5.4 and earlier versions. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can...

eventbank.com Open Redirect vulnerability OBB-1217573

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

SolarWinds Serv-U FTP Server Input Validation Error Vulnerability

SolarWinds Serv-U FTP Server is a set of U.S. SolarWinds FTP and MFT file transfer software. A security vulnerability exists in SolarWinds Serv-U FTP Server versions prior to 15.2.1 that stems from the server not validating parameter paths. No details of the vulnerability are provided at this tim...

go.redirdomain.ru Open Redirect vulnerability

Open Bug Bounty ID: OBB-1213957 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

AZL-44688 CVE-2020-15503 affecting package LibRaw for versions less than 0.19.5-5

LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpackthumb.cpp, postprocessing/memimage.cpp, and utils/thumbutils.cpp. For example, mallocsizeoflibrawprocessedimaget+T.tlength occurs without validating T.tlength...

adserv.yellowpages.co.th Open Redirect vulnerability

Open Bug Bounty ID: OBB-1212819 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

LibVNCServer Buffer Overflow Vulnerability (CNVD-2020-36778)

LibVNCServer is a cross-platform C library that supports the implementation of VNC Virtual Network Computing server or client functionality in a program. A buffer overflow vulnerability exists in the websockets.c file in versions of LibVNCServer prior to 9.12. The vulnerability stems from a web...

CVE-2020-5970

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tampering or denial of service. This affects vGPU version 8.x prior to 8.4, version 9.x prior to 9.4 and version 10.x prior to 10.3...

WordPress Nexos theme SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.Nexos theme is a real estate website theme plugin used in it. WordPress Nexos theme has a SQL injection vulnerability. The...

CVE-2020-15017

NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter...

richardsonpioneer.ca Open Redirect vulnerability

Open Bug Bounty ID: OBB-1206499 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

FreedroidRPG Buffer Overflow Vulnerability

FreedroidRPG is an open source role-playing game from the Freedroid team. A buffer overflow vulnerability exists in the map.c file in FreedroidRPG version 1.0rc2. The vulnerability stems from a networked system or product performing operations in memory without properly validating data boundaries...

commons.lbl.gov Open Redirect vulnerability OBB-1204111

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-11520

The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to write to arbitrary kernel memory addresses because the IOCTL dispatcher lacks pointer validation. Exploiting this vulnerability results in privileged code execution...

PHP-Fusion SQL Injection Vulnerability (CNVD-2020-52839)

PHP-Fusion is a Malaysian PHP-Fusion company based on MySql and PHP open source lightweight content management system . The system contains modules such as news, articles and forums. A SQL injection vulnerability exists in the administration/comments.php endpoint in PHP-Fusion version 9.03.50. Th...

Mattermost Server SQL Injection Vulnerability

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A SQL injection vulnerability exists in Mattermost Server, which stems from a lack of validation of externally entered SQL statements in database-based applications and can be exploited by an attack...