CVE-2021-3012

A cross-site scripting XSS vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror in the URL field of the Parameters tab...

Code injection

An issue was discovered in Nokia NetAct 18A. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that...

CVE-2021-26596

An issue was discovered in Nokia NetAct 18A. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that...

CVE-2021-22848

HGiga MailSherlock contains a SQL Injection. Remote attackers can inject SQL syntax and execute SQL commands in a URL parameter of email pages without privilege...

CVE-2021-22848

HGiga MailSherlock contains a SQL Injection. Remote attackers can inject SQL syntax and execute SQL commands in a URL parameter of email pages without privilege...

Sql injection

HGiga MailSherlock contains a SQL Injection. Remote attackers can inject SQL syntax and execute SQL commands in a URL parameter of email pages without privilege...

CVE-2021-22848

HGiga MailSherlock contains a SQL Injection. Remote attackers can inject SQL syntax and execute SQL commands in a URL parameter of email pages without privilege...

CVE-2021-22848: Improper Neutralization of Special Elements used in an SQL Command

HGiga MailSherlock contains a SQL Injection. Remote attackers can inject SQL syntax and execute SQL commands in a URL parameter of email pages without privilege...

PT-2021-15221

Name of the Vulnerable Software and Affected Versions HGiga MailSherlock affected versions not specified Description The issue allows remote attackers to inject SQL syntax and execute SQL commands in a URL parameter of email pages without privilege. This can be done by manipulating the URL...

CVE-2020-13959: Improper Neutralization of Input During Web Page Generation

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to...

Weseek GROWI cross-site scripting vulnerabilities

Weseek GROWI is a suite of team collaboration software from Weseek Japan. A reflected cross-site scripting vulnerability exists in GROWI 4.2.0 - 4.2.7. The vulnerability stems from insufficient validation of URL query parameters. An attacker can exploit this vulnerability to execute arbitrary...

CVE-2021-27670

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter...

PT-2021-17595

Name of the Vulnerable Software and Affected Versions Appspace version 6.2.4 Description The issue allows for Server-Side Request Forgery SSRF via the url parameter in the "api/v1/core/proxy/jsonprequest" API endpoint. This means an attacker could potentially force the server to make unintended...

CVE-2021-22851

HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter document management page to obtain database schema and data...

CVE-2021-22852

HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter online registration to obtain database schema and data...

Sql injection

HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter document management page to obtain database schema and data...

Sql injection

HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter online registration to obtain database schema and data...

CVE-2021-22852 HGiga OAKloud Portal - SQL injection -2

HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter online registration to obtain database schema and data...

CVE-2021-22851 HGiga OAKloud Portal - SQL injection -1

HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter document management page to obtain database schema and data...

CVE-2019-4687

IBM Security Guardium Data Encryption GDE 3.0.0.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 171823...