CVE-2014-4161

Cross-site scripting XSS vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management SRM allows remote attackers to inject arbitrary web script or HTML via the url parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management SRM allows remote attackers to inject arbitrary web script or HTML via the url parameter...

PT-2014-5710

Name of the Vulnerable Software and Affected Versions SAP Supplier Relationship Management SRM affected versions not specified Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter in the la/umTestSSO.jsp...

PT-2014-5712

Name of the Vulnerable Software and Affected Versions SAP Supplier Relationship Management SRM affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the url parameter in the la/umTestSSO.jsp file...

CVE-2014-4161: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management SRM allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2014-4159: Undefined Security Weakness

Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier Relationship Management SRM allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter...

PT-2014-5638

Name of the Vulnerable Software and Affected Versions Videos Tube version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the url parameter to specific API endpoints, such as "videocat.php" or "single.php". Recommendations For version 1.0,...

CVE-2014-3962: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Videos Tube 1.0 allow remote attackers to execute arbitrary SQL commands via the url parameter to 1 videocat.php or 2 single.php...

FineCMS v1.8任意文件下载

简要描述： 代码审计是个技术活，需要很好的耐心.. o︶︿︶o 详细说明： 出现问题的版本是FineCMS V1.8.0 最新版。 1.顺藤摸瓜 漏洞文件：controllers/ApiController.php downAction方法 public function downAction $data = fnauthcodebase64decode$this-get'file', 'DECODE'; $file = isset$data'finecms' && $data'finecms' ? $data'finecms' : ''; if empty$file...

Crlf injection

CRLF injection vulnerability in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter in a URL...

Open redirect

Open redirect vulnerability in zport/aclusers/cookieAuthHelper/loginform in Zenoss 4.2.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the camefrom parameter...

[RT-SA-2014-003] Metadata Information Disclosure in OrbiTeam BSCW

Advisory: Metadata Information Disclosure in OrbiTeam BSCW RedTeam Pentesting discovered an information disclosure vulnerability in OrbiTeam's BSCW collaboration software. An unauthenticated attacker can disclose metadata about internal objects which are stored in BSCW. Details ======= Product:...

Open redirect

Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backUrl parameter in a changepwd action to...

JVN#93004610: Redmine vulnerable to open redirect

Redmine is a project management software. Redmine contains an open redirect vulnerability due to insufficient checking of the URL parameter. Impact A user who logs into Redmine may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack. Solution Upda...

Open redirect

Open redirect vulnerability in the redirectbackordefault function in app/controllers/applicationcontroller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url backurl parameter...

PT-2014-2288

Name of the Vulnerable Software and Affected Versions Zingiri Forum plugin versions prior to 1.4.4 Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the zing forum output function. This is achieved by including a .. dot dot in the...

CVE-2013-2642

Sophos Web Appliance before 3.7.8.2 allows 1 remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter to the Block page, when using the userworkstation variable in a customized template, and remote authenticated users to execute arbitrary commands via she...

CVE-2013-2042

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the url parameter to 1 apps/bookmarks/ajax/addBookmark.php or 2 apps/bookmarks/ajax/editBookmark.php...

Open redirect

Open redirect vulnerability in the Login Page index.php in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirecturl parameter...

CVE-2013-2042

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the url parameter to 1 apps/bookmarks/ajax/addBookmark.php or 2 apps/bookmarks/ajax/editBookmark.php...