An open redirect vulnerability exists in KodExplorer 4.52. By manipulating the 'link' parameter in the URL, an attacker can craft a malicious URL that appears legitimate to redirect users to a different, malicious website upon login.
By tricking a user into visiting a malicious website, an attacker could exploit this vulnerability in IBM Security Verify Access 10.0.0 - 10.0.8 to redirect the user to a different site that appears legitimate, potentially leading to the disclosure of sensitive information or enabling further attacks.
The INCLUDEPICTURE Field Code in Microsoft Word allows for the insertion of arbitrary URLs into a document. This functionality can be abused by an attacker to obtain the contents of files on the victim user's system. By including the URL in the field code and referencing files on the victim's system, the attacker can potentially access sensitive information. This vulnerability can be particularly dangerous in situations where documents are constantly being shared and updated.
An attacker can exploit this vulnerability by supplying the URI of a malicious site through the 'sap-exiturl' parameter. This can lead to various attacks, including theft of cookie-based authentication credentials and phishing-style attacks.
The vulnerability allows an attacker to misrepresent the status bar in the Apple Safari Web Browser. By creating an HTML form with a legitimate site as the submit value and an attacker-specified site as the action property, the attacker can mislead users into following a link to a malicious site. The same effect can be achieved by embedding the malicious form in a link using the HTML Anchor tag and specifying the legitimate site as the href property.
A remote URI obfuscation vulnerability has been found in Internet Explorer's search pane functionality. This issue is due to a failure of the application to present the URI address of HTML and script code loaded into the search pane. An attacker can exploit this vulnerability to display misleading information in the address bar of the browser, making it seem like the web page is from a trusted location. This can be used to facilitate phishing attacks and other types of attacks.
HP System Management Homepage is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing attacks; other attacks are possible.
agXchange ESM is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing attacks; other attacks are possible.
IBM Lotus Notes is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing attacks; other attacks are possible.
This module abuses a filename spoofing vulnerability in WinRAR. The vulnerability exists when opening ZIP files. The file names showed in WinRAR when opening a ZIP file come from the central directory, but the file names used to extract and open contents come from the Local File Header. This inconsistency allows to spoof file names when opening ZIP files with WinRAR, which can be abused to execute arbitrary code, as exploited in the wild in March 2014.
Services By CQR