3819 matches found
Design/Logic Flaw
A vulnerability in a URL parameter of Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to perform site redirection. More Information: CSCzu78401. Known Affected Releases: T28.1...
CVE-2017-3799
CVE-2017-3799 concerns a URL-parameter open-redirect vulnerability in Cisco WebEx (WebEx Meeting Center). The Cisco advisory attributes the issue to insufficient input validation, where an attacker could craft a link containing a remote site URL in the affected parameter to redirect users to a ma...
PT-2017-16104
Name of the Vulnerable Software and Affected Versions Cisco WebEx Meeting Center version T28.1 Description A vulnerability in a URL parameter could allow an unauthenticated, remote attacker to perform site redirection. Recommendations For Cisco WebEx Meeting Center version T28.1, update to a...
DEBIAN-CVE-2016-7999
ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery SSRF attacks via a URL in the varurl parameter in a validerxml action...
CVE-2016-7169
Directory traversal vulnerability in the FileUploadUpgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter...
CVE-2016-7169
Directory traversal vulnerability in the FileUploadUpgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter...
Directory traversal
Directory traversal vulnerability in the FileUploadUpgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter...
useragentstring.com XSS vulnerability
Vulnerable URL: http://www.useragentstring.com/pages/useragentstring.php?name=Chrome" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 90086 VIP website status:| No Check...
feriaok.com.bo XSS vulnerability
Vulnerable URL: http://www.feriaok.com.bo/clasificados?q=%3C/script%3E%3Cimg%20src=x%20onerror=prompt/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1082684 VIP websit...
CVE-2016-1000229
It was found that swagger-ui contains a cross site scripting XSS vulnerability in the key names in the JSON document. An attacker could use this flaw to supply a key name with script tags which could cause arbitrary code execution. Additionally it is possible to load the arbitrary JSON files...
Trend Micro Control Manager task_controller Information Disclosure
An information disclosure vulnerability has been reported in Trend Micro Control Manager. The vulnerability is due to lack of validation of the 'url' parameter in the request for taskcontrol.php. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted HT...
SQL Injection Vulnerability in the groupUrl Parameter of getGroupedProjectTemplate on the Internet User Speed Measurement Platform of Freescale Technology (Beijing) Co.
FeiShiDa Technology Beijing Co., Ltd. Internet user speed test platform is used to provide users with mobile broadband online test WEB system. The product has a SQL injection vulnerability, the vulnerability URL is: http://target/getGroupedProjectTemplate?groupUrl=, the injection parameter is:...
SQL Injection Vulnerability in Fuzhou Tranda Special Equipment Safety Monitoring System
Fuzhou Chuangda special equipment safety monitoring system using B / S structure, the use of J2EE for development, the system can run on any operating system platform, running into the server and client operation, the server runs the corresponding WEB APPLICATION services such as: TOMCAT, JBOSS,...
Khan Academy: OPEN URL REDIRECT through PNG files
An abuse of the imageurl parameter when saving a CS program was able to create an arbitrary external redirect. We now validate the parameter before using it. I have found a way through which an attacker can use png files to redirect to malicious domain...
rentcar.alkhouzama.ma XSS vulnerability
Vulnerable URL: http://rentcar.alkhouzama.ma/index.php?lang=zh-CN"...
Trend Micro Control Manager task_controller Information Disclosure Vulnerability
This vulnerability allows remote attackers to leak sensitive information on vulnerable installations of Trend Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within taskcontroller.php. The url parameter does not properly sanitize the...
Cross-Site Scripting
Overview Affected versions of swagger-ui are vulnerable to cross-site scripting via the url query string parameter. Recommendation Update to 2.2.1 or later. References - GitHub Issue - GitHub Advisory...
Cross-Site Scripting
Overview Affected versions of swagger-ui contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document. Proof of Concept The vulnerable object structure is: "definitions": "arbitraryVal": "properties": "": "LoremIpsum" Malicious JSON documents can ...
Bumble: Change contents of the careers iframe in https://corp.badoo.com/jobs
Hi again badoo team , In https://corp.badoo.com/jobs/?p= if you check the page you'll see an iframe from https://jobs.jobvite.com/badoo/ , the p parameter is used to control the iframe link for example if you added https://corp.badoo.com/jobs/?p=somepath the iframe link will be...