Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the redirect URL parameter. An attacker can execute arbitrary scripts in the context of a user's browser by convincing the user to follow a crafted link. Details Cross-site scripting or XSS is a code...

CVE-2022-29349: Improper Neutralization of Input During Web Page Generation

kkFileView v4.0.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

PT-2022-19555

Name of the Vulnerable Software and Affected Versions kkFileView version 4.0.0 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the url parameter at the "/controller/OnlinePreviewController.java" endpoint. Recommendations For...

PT-2022-19316

Name of the Vulnerable Software and Affected Versions Subconverter version 0.7.2 Description A remote code execution issue allows attackers to execute arbitrary code by crafting specific config and url parameters. Recommendations For Subconverter version 0.7.2, at the moment, there is no...

CVE-2022-29642

TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 were discovered to contain a stack overflow via the url parameter in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

Stack overflow

TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 were discovered to contain a stack overflow via the url parameter in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2022-29642

CVE-2022-29642 affects TOTOLINK A3100R devices (firmware versions V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129). The root cause is a stack overflow in the setUrlFilterRules function triggered by a crafted POST request to the urlFilterRules parameter, enabling an attacker to cause a Denial ...

PT-2022-19746

Name of the Vulnerable Software and Affected Versions TOTOLINK A3100R versions V4.1.2cu.5050 B20200504 through V4.1.2cu.5247 B20211129 Description A stack overflow issue was discovered via the url parameter in the setUrlFilterRules function, allowing attackers to cause a Denial of Service DoS via...

Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the 1 service...

GHSA-9FC5-Q25C-R2WR Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the 1 service...

GHSA-W3P6-94X2-XCVM Apache Ambari Open Redirect

Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter...

Apache Ambari Open Redirect

Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter...

GHSA-5PMG-QH2C-7J24 phpMyAdmin allows remote attackers to spoof content via the url parameter

The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter...

phpMyAdmin allows remote attackers to spoof content via the url parameter

The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter...

GHSA-FH35-P8PH-P545 Silverstripe CMS Open Redirect

Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter to dev/build...

Silverstripe CMS Open Redirect

Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter to dev/build...

Plone Open Redirect Vulnerability

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to 1...

CVE-2020-22983

A Server-Side Request Forgery SSRF vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a server-side request forgery SSRF attack via the srcURL parameter to the shortURL task...

Contao Core directory traversal vulnerability

A logged in back end user can include arbitrary PHP files by manipulating an URL parameter. Since Contao does not allow to upload PHP files in the file manager, the attack is limited to the existing PHP files on the server...

TOTOLINK N600R Buffer Overflow Vulnerability (CNVD-2022-50670)

TOTOLINK N600R is a wireless router from Gion Electronics TOTOLINK, Taiwan, China.A buffer overflow vulnerability exists in TOTOLINK N600R V4.3.0cu.7647B20210106, which stems from a lack of length validation of the url parameter in the FUN00415bf0 function. An attacker could exploit this...