PT-2020-17412

Name of the Vulnerable Software and Affected Versions HGiga MailSherlock affected versions not specified Description The issue allows attackers to inject and launch SQL commands through a URL parameter, potentially leading to SQL Injection attacks. Recommendations At the moment, there is no...

PT-2020-17413

Name of the Vulnerable Software and Affected Versions HGiga MailSherlock affected versions not specified Description The issue is related to a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages. Recommendations At the moment, there is no...

CVE-2020-35742: Improper Neutralization of Special Elements used in an SQL Command

HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter...

CVE-2020-35930: Improper Neutralization of Input During Web Page Generation

Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI...

CVE-2020-35743: Improper Neutralization of Special Elements used in an SQL Command

HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages...

Cxuucms Cross-Site Scripting Vulnerabilities

CxuuCms is an easy-to-use, open source PHP+Mysql based content management system. CXUUCMS 3.1 suffers from a reflective cross-site scripting vulnerability. Attackers can use the vulnerability to inject arbitrary Web script or HTML via the imgurl parameter of admin.php?c=content&a=add...

CVE-2020-35589

The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed b...

CVE-2020-26836

SAP Solution Manager Trace Analysis, version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the...

CVE-2020-26836: URL Redirection to Untrusted Site

SAP Solution Manager Trace Analysis, version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the...

CVE-2020-29135

cPanel before 90.0.17 has multiple instances of URL parameter injection SEC-567...

Code injection

cPanel before 90.0.17 has multiple instances of URL parameter injection SEC-567...

CVE-2020-29135

CVE-2020-29135 affects cPanel prior to 90.0.17, with multiple instances of URL parameter injection (SEC-567). The connected records identify the affected product and the vulnerability type, but do not provide explicit exploitation details, affected components beyond the web interfaces, or a confi...

PT-2020-17095

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 90.0.17 Description The issue concerns multiple instances of URL parameter injection. Recommendations For versions prior to 90.0.17, update to version 90.0.17 or later to resolve the issue...

CVE-2020-29135: Inappropriate Encoding for Output Context

cPanel before 90.0.17 has multiple instances of URL parameter injection SEC-567...

cPanel injection vulnerability

cPanel is a set of Web-based host control management system of the U.S. cPanel. A URL parameter injection vulnerability exists in multiple interfaces in versions of cPanel prior to 90.0.17. No detailed vulnerability details are provided at this time...

CVE-2020-5651

SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary SQL commands via a specially crafted URL...

PT-2020-16565 · Emby · Emby Server

Name of the Vulnerable Software and Affected Versions: Emby Server versions prior to 4.5.0 Description: The issue allows for Server-Side Request Forgery SSRF via the ImageURL parameter in the Items/RemoteSearch/Image endpoint. This means an attacker could potentially force the server to make...

CVE-2020-7741 Cross-site Scripting (XSS)

This affects the package hellojs before 1.18.6. The code get the param oauthredirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauthredirect, such as javascript:alert1...

Cross-site Scripting (XSS)

Overview hellojs is a Javascript RESTFUL API library for connecting with OAuth2 services. Affected versions of this package are vulnerable to Cross-site Scripting XSS. The code gets the param oauthredirect from url and passes it to location.assign without any sanitisation. So an attack can pass j...

CVE-2020-5975

NVIDIA GeForce NOW, versions prior to 2.0.23 on Windows and macOS, contains a vulnerability in the desktop application software that includes sensitive information as part of a URL, which may lead to information disclosure...