HTTP Parameter Override

Home/Alerts/Alert detail/

Risk:
Medium

Type:
Passive

CWE:
CWE-20

Summary: Unspecified form action: HTTP parameter override attack potentially possible. This is a known problem with Java Servlets but other platforms may also be vulnerable.

Solution: All forms must specify the action URL.

References: https://download.oracle.com/javaee-archive/servlet-spec.java.net/jsr340-experts/att-0317/OnParameterPollutionAttacks.pdf

Top Security News

CISA orders federal agencies to secure Microsoft 365 tenants

Recorded Future CEO applauds "undesirable" designation by Russia

BeyondTrust fixes critical vulnerability in remote access, support solutions (CVE-2024-12356)

Google Chrome uses AI to analyze pages in new scam detection feature

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware

Exploit released for critical WhatsUp Gold RCE flaw, patch now

Microsoft fixes exploited zero-day (CVE-2024-49138)

Common Alerts

MediumMissing Anti-clickjacking Header

HighPath Traversal

MediumCSP: Meta Policy Invalid Directive

MediumParameter Tampering

InformationalSec-Fetch-Site Header is Missing

LowPrivate IP Disclosure

InformationalUser Controllable HTML Element Attribute (Potential XSS)

HighSource Code Disclosure - File Inclusion

HighServer Side Template Injection

InformationalStorable and Cacheable Content

Top CVE List

CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability

CVE-2019-11001 Reolink Multiple IP Cameras OS Command Injection Vulnerability

CVE-2022-23227 NUUO NVRmini 2 Devices Missing Authentication Vulnerability

CVE-2021-40407 Reolink RLC-410W IP Camera OS Command Injection Vulnerability

CVE-2023-36884 Microsoft Windows Search Remote Code Execution Vulnerability

CVE-2024-35250 Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

CVE-2024-55956 Cleo Multiple Products Unauthenticated File Upload Vulnerability

CVE-2020-5849 Unraid Authentication Bypass Vulnerability

CVE-2024-43451 Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability

Common CWEs

CWE-1097 Persistent Storable Data Element without Associated Comparison Control Element

CWE-1107 Insufficient Isolation of Symbolic Constant Definitions

CWE-733 Compiler Optimization Removal or Modification of Security-critical Code

MediumCWE-202 Exposure of Sensitive Information Through Data Queries

HighCWE-293 Using Referer Field for Authentication

CWE-180 Incorrect Behavior Order: Validate Before Canonicalize

CWE-267 Privilege Defined With Unsafe Actions

LowCWE-783 Operator Precedence Logic Error

CWE-1395 Dependency on Vulnerable Third-Party Component

CWE-1075 Unconditional Control Flow Transfer outside of Switch Block

Free security scan for your website

Don't show website scan report rating on the leaderboard