3811 matches found
CVE-2022-23970
The CVE-2022-23970 entry concerns the ASUS RT-AX56U router. A path traversal flaw exists in the update_json function due to insufficient filtering of special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another file with the same filena...
CVE-2022-23970 ASUS RT-AX56U - Path Traversal
ASUS RT-AX56U’s updatejson function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another file with the same file name, which results in service disruption...
CVE-2022-21223
The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function when using hg, the url and/or revision, tag, branch is passed to the hg clone command in a way that additional flags can be set. The additional flags can...
Apache Log4j 2.0.x Multiple Vulnerabilities (Web Application URL Parameter, Log4Shell) - Active Check
Apache Log4j is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2021-42970
Cross Site Scripting XSS vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter...
CVE-2022-26271
74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php...
CVE-2022-26271
74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php...
CVE-2022-26271
74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php...
CVE-2022-26271
74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php...
PT-2022-17757
Name of the Vulnerable Software and Affected Versions 74cmsSE version 3.4.1 Description The issue allows for an arbitrary file read via the url parameter at the indexcontrollerDownload.php endpoint. Recommendations For 74cmsSE version 3.4.1, avoid using the url parameter in the...
Cross site scripting
libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...
CVE-2022-27920
The CVE-2022-27920 entry affects libkiwix (versions 10.0.0 and 10.0.1) with an XSS flaw in the built‑in webserver through the search suggestions URL parameter. The root cause involves improper handling of that URL parameter, enabling cross-site scripting. The vulnerability is fixed in version 10....
CVE-2022-27920
libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...
CVE-2022-27920: Improper Neutralization of Input During Web Page Generation
libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0...
CVE-2022-25221
Money Transfer Management System Version 1.0 allows an attacker to inject JavaScript code in the URL and then trick a user into visit the link in order to execute JavaScript code...
Command injection
Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware...
CVE-2021-45876: Improper Neutralization of Special Elements used in a Command
Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware...
PT-2022-12446
Name of the Vulnerable Software and Affected Versions GARO Wallbox versions affected versions not specified Description The issue concerns unauthenticated command injection in multiple versions of the software. Specifically, the url parameter of the downloadAndUpdate function module is vulnerable...
