CVE-2023-24813 URI validation failure on SVG parsing. Bypass of CVE-2023-23924

Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of image tags and respects xlink:href even if href is specified. However...

CVE-2023-24813 URI validation failure on SVG parsing. Bypass of CVE-2023-23924

Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of image tags and respects xlink:href even if href is specified. However...

CVE-2021-43449

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery SSRF. The document editor service can be abused to read and serve arbitrary URLs as a document...

CVE-2021-43449

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery SSRF. The document editor service can be abused to read and serve arbitrary URLs as a document...

Okta NodeJS OIDC Middleware 输入验证错误漏洞

Okta NodeJS OIDC Middleware is an Okta open source OIDC support for Fortran applications. A security vulnerability exists in Okta NodeJS OIDC Middleware versions prior to 5.0.0, which stems from the presence of an open redirection vulnerability that allows an attacker to redirect a user to an...

Brave Software: Brave News feeds can open arbitrary chrome: URLs

An issue was discovered in Brave Browser versions 1.46.144 and earlier. The Brave News feeds feature can be exploited to open arbitrary chrome: URLs, bypassing the Same Origin Policy SOP and potentially granting access to privileged URLs. An attacker could use this vulnerability to gain...

CVE-2022-38212

Protections against potential Server-Side Request Forgery SSRF vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeratio...

CVE-2022-38203

Protections against potential Server-Side Request Forgery SSRF vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeratio...

Server side request forgery (ssrf)

Protections against potential Server-Side Request Forgery SSRF vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeratio...

Server side request forgery (ssrf)

Protections against potential Server-Side Request Forgery SSRF vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeratio...

CVE-2022-41965

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to...

CVE-2022-41965 Opencast Authenticated OpenRedirect Vulnerability

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to...

PT-2022-7400 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.4 Description: The issue is related to the usage of RSS feeds or an external calendar in planning, which is subject to a Server-Side Request Forgery SSRF exploit. If a remote script returns a redirect response, the...

Design/Logic Flaw

HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users t...

CVE-2022-38184

There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs...

Improper access control

There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs...

PT-2022-4367 · Esri · Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Portal for ArcGIS versions 10.8.1 and below Description: The issue is related to improper access control in Portal for ArcGIS, which could allow a remote, unauthenticated attacker to access an API. This may induce Esri Portal for ArcGIS to re...

Esri Portal For ArcGis 安全漏洞

Esri Portal For ArcGis is a component from Esri, Inc. that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A security vulnerability exists in Portal for ArcGIS version 10.8.1 and earlier, which stems from the presence of an...

Design/Logic Flaw

Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs...

CVE-2021-40604

A Server-Side Request Forgery SSRF vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated us...