862 matches found
CVE-2020-10211
A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to execute arbitrary scripts due to insufficient validation of URL parameters. A successful exploit could allow an attacker to gain access to sensitive...
Open Redirection
centreon/centreon is vulnerable to open redirection. A hidden parameter p allows an attacker to add additional URL parameters using the URL encoded & character and redirect users to an arbitrary page. This vulnerability can be leveraged to execute arbitrary code on the system when a privileged us...
CVE-2019-10221
A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a...
Cross site scripting
The SAP Commerce Testweb Extension, versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are reflected in the HTTP responses without escaping/sanitization, leading to Reflected Cross Site Scripting...
CVE-2020-10246
MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statisticsorgs.ctp...
CVE-2020-10246
MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statisticsorgs.ctp...
CVE-2020-10246
CVE-2020-10246 affects MISP 2.4.122 with a reflected XSS vulnerability in URL parameters, specifically in app/View/Users/statistics_orgs.ctp. Root cause: unsanitized URL parameters leading to reflected XSS. Existence of concrete details in connected sources confirms the affected component and fil...
CVE-2020-10246
MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statisticsorgs.ctp...
CVE-2019-10221
A Reflected Cross Site Scripting vulnerability was found in the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute...
Information disclosure
IBM Cognos Controller stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 162659...
CVE-2019-4412
IBM Cognos Controller is affected by CVE-2019-4412, where sensitive information can be exposed via URL parameters. The issue affects IBM Cognos Controller versions 10.3.0 FP1 IF13, 10.3.1 IF12, 10.4.0 FP1 IF4, 10.4.0 FP1 IF5, and 10.4.1 IF1/IF2. Root cause involves information stored in URL param...
CVE-2019-4412
IBM Cognos Controller stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 162659...
CVE-2019-4397
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM...
CVE-2019-4397
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM...
Information disclosure
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM...
CVE-2019-4397
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM...
CVE-2019-4397
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise are affected by CVE-2019-4397. Version ranges include 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5. The root cause is storing sensitive information in URL parameters, which can disclose data if URLs are exposed via server logs, the refer...
Crlf injection
Some web components in the ArubaOS software are vulnerable to HTTP Response splitting CRLF injection and Reflected XSS. An attacker would be able to accomplish this by sending certain URL parameters that would trigger this vulnerability...
CVE-2019-5314
Some web components in the ArubaOS software are vulnerable to HTTP Response splitting CRLF injection and Reflected XSS. An attacker would be able to accomplish this by sending certain URL parameters that would trigger this vulnerability...