2934 matches found
CVE-2018-20121
Podcast Generator 2.7 has stored cross-site scripting XSS via the URL addcategory parameter...
Cross site scripting
Podcast Generator 2.7 has stored cross-site scripting XSS via the URL addcategory parameter...
CVE-2018-20121
Podcast Generator 2.7 has stored cross-site scripting XSS via the URL addcategory parameter...
CVE-2019-9741
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command...
UBUNTU-CVE-2019-9741
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command...
CVE-2019-9741
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command...
DEBIAN-CVE-2019-9740
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the query string after a ? charact...
PT-2019-9646 · Netdata +4 · Netdata +4
Name of the Vulnerable Software and Affected Versions: Netdata version 1.10.0 Description: An issue exists where Log Injection or Log Forgery is possible via a %0a sequence in the url parameter to the "api/v1/registry" endpoint. Recommendations: For Netdata version 1.10.0, avoid using the url...
dotCMS Open Redirect Vulnerability
dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A security vulnerability exists in dotCMS versions prior to 5.0.2. An attacker can exploit this vulnerability to...
CVE-2019-9592
A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...
CVE-2019-9592
A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...
MeteoTemplate 17.1 Nectarine windDirection 2.2 Open Redirection
Exploit Title : MeteoTemplate 17.1 Nectarine windDirection Plugins 2.2 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 26/02/2019 Vendor Homepage : meteotemplate.com Software Download Link :...
CVE-2019-8432
In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter...
CVE-2019-8432
In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter...
CVE-2019-8432
CmsEasy 7.0 is affected by a cross-site scripting (XSS) vulnerability in the ckplayer.php URL parameter. The issue is documented across multiple sources (NVD, Red Hat, CVE lists) as an XSS in CmsEasy 7.0 via ckplayer.php, but no further technical specifics (such as exact code path, exploit detail...
CVE-2018-15657
An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter...
PT-2019-16767 · Labkey · Labkey Server Community Edition
Name of the Vulnerable Software and Affected Versions: LabKey Server Community Edition versions prior to 18.3.0-61806.763 Description: The issue is related to an open redirect vulnerability. It affects the / r1/ API endpoint, specifically the returnURL parameter, allowing an unauthenticated remot...
NEC Aterm W300P Buffer Overflow Vulnerability
The NEC Aterm W300P is a wireless router from Nippon Electric NEC. A buffer overflow vulnerability exists in the NEC Aterm W300P using firmware version 1.0.13 and earlier, which can be exploited by an attacker to execute arbitrary code with the help of the 'submit-url' parameter...
Design/Logic Flaw
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode parameter of a certain URL...