CVE-2022-29810

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter...

CVE-2022-29810: Insertion of Sensitive Information into Log File

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter...

karma input validation error vulnerability

karma is a simple tool that allows you to execute JavaScript code in multiple real browsers. karma versions prior to 6.3.16 have a security vulnerability that stems from a lack of validation of returned url query parameters, which could be exploited to perform redirect attacks...

CVE-2021-23495 Open Redirect

The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the returnurl query parameter...

CVE-2022-25196

Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in...

Authentication flaw

Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in...

CVE-2022-25196

Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in...

Brave Software: New XSS vector in ReaderMode with %READER-TITLE-NONCE%

A new XSS vulnerability was discovered in Brave iOS 1.31.1 and higher, which allowed attackers to execute malicious scripts on ReaderMode pages. The vulnerability was caused by a relaxation of the CSP rule, which allowed scripts with nonce-%READER-TITLE-NONCE% to be executed. Attackers could...

WordPress Plugin "Booking Package - Appointment Booking Calendar System" vulnerable to cross-site scripting

Overview WordPress Plugin "Booking Package - Appointment Booking Calendar System" provided by Saasproject contains a cross-site scripting vulnerability CWE-79 due to the flaw in handling some URL query parameters. Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IP...

JVN#68066589: WordPress Plugin "Booking Package - Appointment Booking Calendar System" vulnerable to cross-site scripting

WordPress Plugin "Booking Package - Appointment Booking Calendar System" provided by Saasproject contains a cross-site scripting vulnerability CWE-79 due to the flaw in handling some URL query parameters. Impact An arbitrary script may be executed on the web browser of the user who is accessing t...

Backdoor.Win32.VB.afu Insecure Transit

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/c6ba7fcb9eb9bdd7e081e2e84e784dcbB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.VB.afu Vulnerability: Insecure Transit Password Disclosure Description: The malware...

GROWI Cross-Site Scripting Vulnerability (CNVD-2021-19695)

Weseek GROWI is a suite of team collaboration software from Weseek Japan. A reflected cross-site scripting vulnerability exists in GROWI 4.2.0 - 4.2.7. The vulnerability stems from insufficient validation of URL query parameters. An attacker can exploit this vulnerability to execute arbitrary...

CVE-2021-20672

Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI v4.2 Series versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2021-20672: Improper Neutralization of Input During Web Page Generation

Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI v4.2 Series versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors...

PT-2021-14131

Name of the Vulnerable Software and Affected Versions: GROWI versions 4.2.0 through 4.2.7 Description: The issue is related to a reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters. This allows remote attackers to inject an arbitrary script via...

CVE-2021-21607

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors...

Cloudbees Jenkins 跨站脚本漏洞

Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . A cross-site scripting...

PT-2020-7939

Name of the Vulnerable Software and Affected Versions: swagger-ui versions prior to 2.2.1 Description: The issue exists due to the automatic execution of external Javascript loaded via the url query string parameter when a Content-Type: application/javascript header is included. An attacker can...

PT-2020-21291

Name of the Vulnerable Software and Affected Versions swagger-ui versions prior to 2.2.1 Description The issue concerns cross-site scripting via the url query string parameter. Recommendations Update to version 2.2.1 or later...

OMERO.web Information Disclosure Vulnerability

OMERO.web is a client program from the Open Microscopy Environment team for viewing images on the OMERO server from a web browser. A security vulnerability exists in OMERO.web versions prior to 5.6.3, which arises when the program passes sensitive data elements, such as a session key, as URL quer...