3814 matches found
CVE-2019-18636
A cross-site scripting XSS vulnerability in Jitbit .NET Forum aka ASP.NET forum 8.3.8 allows remote attackers to inject arbitrary web script or HTML via the gravatar URL parameter...
Python urllib2 and urllib injection vulnerabilities
Python is an open source, object-oriented programming language from the Python Software Foundation. The language has features such as extensibility, support for modules and packages, and support for multiple platforms. urllib is one of the modules used to handle URLs. urllib2 is one of the module...
ALPINE-CVE-2019-18348
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the host component of a URL follow...
CVE-2019-18348
Removed by vendor...
CVE-2019-18348
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the host component of a URL follow...
CVE-2019-18348: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the host component of a URL follow...
Cross site scripting
In FusionPBX up to v4.5.7, the file app\conferencesactive\conferenceinteractive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS...
CVE-2019-16970: Improper Neutralization of Input During Web Page Generation
In FusionPBX up to 4.5.7, the file app\sipstatus\sipstatus.php uses an unsanitized "savemsg" variable coming from the URL, which is reflected in HTML, leading to XSS...
CVE-2016-11015
NETGEAR JNR1010 devices prior to firmware 1.0.0.32 are affected by a CSRF vulnerability in the web UI: cgi-bin/webproc can be invoked via the parameter :InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL. The issue enables cross-site request forgery. Remediation: upgrade to firmware vers...
Command injection
An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url parameter...
CVE-2019-9741
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command...
CVE-2015-9467
The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter...
PT-2019-12356
Name of the Vulnerable Software and Affected Versions Softing uaGate SI version 1.60.01 Description An issue was discovered in the software, where a CGI script is vulnerable to command injection with a maliciously crafted url parameter. Recommendations For version 1.60.01, consider restricting...
CVE-2015-9467: Improper Neutralization of Special Elements used in an SQL Command
The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter...
CVE-2019-11527: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url parameter...
PT-2019-7426
Name of the Vulnerable Software and Affected Versions broken-link-manager plugin versions prior to 0.5.0 Description The issue concerns SQL injection via the url parameter in the wpslDelURL or wpslEditURL functions. This allows for potential SQL injection attacks. Recommendations For versions pri...
CVE-2019-15810
Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter...
CVE-2019-15810
Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter...